ACI ACI FTK Toolkit & Investigation Workflow 2

Question 1

Which AccessData tool is specifically designed for decrypting files protected by popular encryption applications like BitLocker and TrueCrypt?

Accepted Answer

PRTK (Password Recovery Toolkit)

Answer

PRTK is AccessData's dedicated password recovery tool that supports dictionary, hybrid, and brute-force attacks against encrypted files and full-disk encryption.

Question 2

When adding evidence to an FTK case, what is the difference between a 'Physical Drive' and 'Logical Drive' evidence type?

Accepted Answer

Physical Drive acquires raw sector data including unallocated space; Logical Drive captures only allocated file system data

Answer

Physical drive acquisition captures the entire raw disk including unallocated, slack, and deleted file space, while logical acquisition only captures active file system contents.

Question 3

In FTK's email analysis module, what does examining the 'Email Thread' view help an investigator determine?

Accepted Answer

The chronological conversation flow between participants including deleted replies

Answer

The email thread view reconstructs conversations in chronological order, helping investigators understand the full communication context including replies that may have been deleted.

Question 4

What is the significance of 'slack space' in digital forensics investigations using FTK?

Accepted Answer

It is the area between the end of a file and the end of its allocated cluster, which may contain remnant data from previously deleted files

Answer

File slack space exists because files rarely fill their allocated clusters exactly, leaving remnant data from overwritten files that can be recovered as evidence.

Question 5

Which FTK feature allows an investigator to search for specific text patterns across all evidence, including inside documents and emails?

Accepted Answer

Full-text index search with live search

Answer

FTK's full-text indexing and live search allow investigators to search for keywords, phrases, and regex patterns across all processed evidence simultaneously.

(ACI) AccessData Certified Investigator Practice Test

(ACI) AccessData Certified Investigator Practice Test

ACI ACI FTK Toolkit & Investigation Workflow 2