ACI FTK Toolkit & Investigation Workflow Flashcards

In AccessData FTK, what does the 'Expand Compound Files' option do during evidence processing?

Answer: Extracts and indexes content from ZIP, PST, and other container files

Expanding compound files causes FTK to extract and index the contents of archives, email stores, and other container formats for analysis.

What is the purpose of the 'Case Log' in an FTK investigation?

Answer: To record all investigative actions and maintain an audit trail

The FTK Case Log maintains a timestamped record of all analyst actions within a case, supporting chain of custody and audit requirements.

Which FTK processing option helps recover deleted files by examining unallocated disk space?

Answer: Data Carving

Data carving scans unallocated space for file headers and footers to reconstruct deleted or fragmented files without relying on file system metadata.

When using FTK Imager to acquire evidence, what does selecting the 'Verify images after they are created' option accomplish?

Answer: It hashes the source and image to confirm the copy is bit-for-bit identical

Post-acquisition verification hashes both the source drive and the resulting image to confirm forensic integrity and that no data was altered during imaging.

In FTK, what does 'file signature analysis' reveal about a file?

Answer: Whether the file's actual format matches its extension, potentially indicating disguised files

File signature analysis compares the file header magic bytes against known signatures to detect files whose extensions have been changed to hide their true type.

What is the primary advantage of using FTK's database-driven architecture compared to older forensic tools?

Answer: It allows multiple investigators to simultaneously access and work on the same case

FTK's centralized database architecture enables multi-investigator collaboration by allowing concurrent access to a single case from multiple workstations.