ACE Tool Proficiency & Analysis Techniques 3 — Questions and Answers
Question 1: Which AccessData tool is specifically designed to perform distributed processing of forensic cases across multiple machines to speed up analysis?
- FTK Central
- PRTK Distributed Network Attack (DNA)
- Enterprise with Processing Engines (Correct answer)
- Registry Viewer Grid Mode
Correct answer: Enterprise with Processing Engines
FTK Enterprise with Processing Engines allows distributed forensic processing across multiple machines to handle large case volumes faster.
Question 2: When carving files from unallocated space in FTK, which two values define the boundaries of a carved file?
- File name and creation timestamp
- Header signature and footer signature (Correct answer)
- Inode number and directory entry pointer
- Hash value and file size from MFT
Correct answer: Header signature and footer signature
File carving identifies files by locating known file type header signatures and their corresponding footer signatures in raw disk data.
Question 3: In FTK's email analysis, which artifact from a Microsoft Outlook PST file is most valuable for establishing a timeline of suspect communications?
- The PST file's last modified timestamp on disk
- Individual email sent and received timestamps stored in the message properties (Correct answer)
- The OST synchronization log
- The Outlook profile registry key last write time
Correct answer: Individual email sent and received timestamps stored in the message properties
Individual message properties within a PST store precise sent and received timestamps that are more reliable for timeline reconstruction than file system metadata.
Question 4: An examiner uses FTK to analyze a FAT32 volume and notices directory entries with a first byte of 0xE5. What does this signify?
- A system file protected by Windows File Protection
- A deleted directory entry that may still have recoverable data (Correct answer)
- An extended attribute entry for long file name support
- A volume label entry at the root directory
Correct answer: A deleted directory entry that may still have recoverable data
In FAT file systems, a 0xE5 value in the first byte of a directory entry indicates the file was deleted, though its cluster chain may still hold recoverable data.
Question 5: During a FTK examination, an examiner identifies files with very high entropy values. What is the MOST likely explanation?
- The files are standard Windows system DLLs
- The files are compressed or encrypted (Correct answer)
- The files are empty placeholder documents
- The files contain only ASCII text data
Correct answer: The files are compressed or encrypted
High entropy values indicate data that is highly random, which is characteristic of encrypted or compressed files where patterns are intentionally obscured.
Question 6: When using FTK Imager's 'Capture Memory' function, what type of file is created that an examiner would later load into a memory analysis tool?
- A .vmem virtual machine memory snapshot
- A raw .mem or .dmp memory dump file (Correct answer)
- An E01 EnCase evidence file
- A hibernation file (hiberfil.sys) clone
Correct answer: A raw .mem or .dmp memory dump file
FTK Imager's Capture Memory function creates a raw memory dump file (.mem or .dmp) containing the full contents of physical RAM at capture time.
Question 7: Which technique does AccessData's DNA (Distributed Network Attack) use to accelerate password recovery that PRTK alone cannot leverage?
- GPU-accelerated cracking on a single workstation
- Distributing cracking tasks across multiple networked computers simultaneously (Correct answer)
- Rainbow table lookups from a cloud-based database
- Brute-force attacks using quantum computing simulation
Correct answer: Distributing cracking tasks across multiple networked computers simultaneously
DNA distributes password recovery workloads across many networked machines, dramatically increasing throughput compared to single-machine PRTK cracking.
ACE Tool Proficiency & Analysis Techniques 3
Which AccessData tool is specifically designed to perform distributed processing of forensic cases across multiple machines to speed up analysis?