ACE Tool Proficiency & Analysis Techniques 3

Question 1

Which AccessData tool is specifically designed to perform distributed processing of forensic cases across multiple machines to speed up analysis?

Accepted Answer

Enterprise with Processing Engines

Answer

FTK Enterprise with Processing Engines allows distributed forensic processing across multiple machines to handle large case volumes faster.

Question 2

When carving files from unallocated space in FTK, which two values define the boundaries of a carved file?

Accepted Answer

Header signature and footer signature

Answer

File carving identifies files by locating known file type header signatures and their corresponding footer signatures in raw disk data.

Question 3

In FTK's email analysis, which artifact from a Microsoft Outlook PST file is most valuable for establishing a timeline of suspect communications?

Accepted Answer

Individual email sent and received timestamps stored in the message properties

Answer

Individual message properties within a PST store precise sent and received timestamps that are more reliable for timeline reconstruction than file system metadata.

Question 4

An examiner uses FTK to analyze a FAT32 volume and notices directory entries with a first byte of 0xE5. What does this signify?

Accepted Answer

A deleted directory entry that may still have recoverable data

Answer

In FAT file systems, a 0xE5 value in the first byte of a directory entry indicates the file was deleted, though its cluster chain may still hold recoverable data.

Question 5

During a FTK examination, an examiner identifies files with very high entropy values. What is the MOST likely explanation?

Accepted Answer

The files are compressed or encrypted

Answer

High entropy values indicate data that is highly random, which is characteristic of encrypted or compressed files where patterns are intentionally obscured.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Tool Proficiency & Analysis Techniques 3