ACI ACI FTK Toolkit & Investigation Workflow 2 — Questions and Answers
Question 1: Which AccessData tool is specifically designed for decrypting files protected by popular encryption applications like BitLocker and TrueCrypt?
- FTK Imager
- PRTK (Password Recovery Toolkit) (Correct answer)
- Registry Viewer
- FTK Mobile Phone Examiner
Correct answer: PRTK (Password Recovery Toolkit)
PRTK is AccessData's dedicated password recovery tool that supports dictionary, hybrid, and brute-force attacks against encrypted files and full-disk encryption.
Question 2: When adding evidence to an FTK case, what is the difference between a 'Physical Drive' and 'Logical Drive' evidence type?
- Physical Drive is for SSDs; Logical Drive is for HDDs
- Physical Drive acquires raw sector data including unallocated space; Logical Drive captures only allocated file system data (Correct answer)
- Physical Drive requires a write blocker; Logical Drive does not
- Physical Drive is faster to process than Logical Drive
Correct answer: Physical Drive acquires raw sector data including unallocated space; Logical Drive captures only allocated file system data
Physical drive acquisition captures the entire raw disk including unallocated, slack, and deleted file space, while logical acquisition only captures active file system contents.
Question 3: In FTK's email analysis module, what does examining the 'Email Thread' view help an investigator determine?
- The file size of each email attachment
- The chronological conversation flow between participants including deleted replies (Correct answer)
- The geographic location of the email server
- The encryption standard used by the email client
Correct answer: The chronological conversation flow between participants including deleted replies
The email thread view reconstructs conversations in chronological order, helping investigators understand the full communication context including replies that may have been deleted.
Question 4: What is the significance of 'slack space' in digital forensics investigations using FTK?
- It refers to unused server storage capacity
- It is the area between the end of a file and the end of its allocated cluster, which may contain remnant data from previously deleted files (Correct answer)
- It is temporary storage used by FTK during processing
- It refers to unpartitioned space on a drive
Correct answer: It is the area between the end of a file and the end of its allocated cluster, which may contain remnant data from previously deleted files
File slack space exists because files rarely fill their allocated clusters exactly, leaving remnant data from overwritten files that can be recovered as evidence.
Question 5: Which FTK feature allows an investigator to search for specific text patterns across all evidence, including inside documents and emails?
- Bookmark function
- Full-text index search with live search (Correct answer)
- File signature analysis
- Hash comparison
Correct answer: Full-text index search with live search
FTK's full-text indexing and live search allow investigators to search for keywords, phrases, and regex patterns across all processed evidence simultaneously.
Question 6: During an FTK investigation, an analyst notices a file with a creation date earlier than the operating system installation date. What does this likely indicate?
- A system clock error during formatting
- The file may have been backdated or copied from another system to falsify timestamps (Correct answer)
- The file is a core OS system file
- FTK processed the file incorrectly
Correct answer: The file may have been backdated or copied from another system to falsify timestamps
A file predating the OS installation is anomalous and may indicate timestamp manipulation (timestomping) to conceal when the file was actually placed on the system.
ACI ACI FTK Toolkit & Investigation Workflow 2
Which AccessData tool is specifically designed for decrypting files protected by popular encryption applications like BitLocker and TrueCrypt?