ACI ACI FTK Toolkit & Investigation Workflow 1 — Questions and Answers
Question 1: In AccessData FTK, what does the 'Expand Compound Files' option do during evidence processing?
- Increases the file size limit for imports
- Extracts and indexes content from ZIP, PST, and other container files (Correct answer)
- Decompresses the forensic image file itself
- Converts evidence to a different format
Correct answer: Extracts and indexes content from ZIP, PST, and other container files
Expanding compound files causes FTK to extract and index the contents of archives, email stores, and other container formats for analysis.
Question 2: What is the purpose of the 'Case Log' in an FTK investigation?
- To store the forensic image backup
- To record all investigative actions and maintain an audit trail (Correct answer)
- To list all suspect IP addresses
- To generate the final court report automatically
Correct answer: To record all investigative actions and maintain an audit trail
The FTK Case Log maintains a timestamped record of all analyst actions within a case, supporting chain of custody and audit requirements.
Question 3: Which FTK processing option helps recover deleted files by examining unallocated disk space?
- Index Search Terms
- Data Carving (Correct answer)
- Hash Analysis
- File Signature Verification
Correct answer: Data Carving
Data carving scans unallocated space for file headers and footers to reconstruct deleted or fragmented files without relying on file system metadata.
Question 4: When using FTK Imager to acquire evidence, what does selecting the 'Verify images after they are created' option accomplish?
- It encrypts the image for secure transport
- It hashes the source and image to confirm the copy is bit-for-bit identical (Correct answer)
- It automatically uploads the image to a cloud server
- It scans the image for viruses
Correct answer: It hashes the source and image to confirm the copy is bit-for-bit identical
Post-acquisition verification hashes both the source drive and the resulting image to confirm forensic integrity and that no data was altered during imaging.
Question 5: In FTK, what does 'file signature analysis' reveal about a file?
- The file's digital signature certificate
- Whether the file's actual format matches its extension, potentially indicating disguised files (Correct answer)
- The author's electronic signature
- The file's encryption algorithm
Correct answer: Whether the file's actual format matches its extension, potentially indicating disguised files
File signature analysis compares the file header magic bytes against known signatures to detect files whose extensions have been changed to hide their true type.
Question 6: What is the primary advantage of using FTK's database-driven architecture compared to older forensic tools?
- It requires no hard drive space
- It allows multiple investigators to simultaneously access and work on the same case (Correct answer)
- It eliminates the need for write blockers
- It automatically generates court-admissible reports
Correct answer: It allows multiple investigators to simultaneously access and work on the same case
FTK's centralized database architecture enables multi-investigator collaboration by allowing concurrent access to a single case from multiple workstations.
ACI ACI FTK Toolkit & Investigation Workflow 1
In AccessData FTK, what does the 'Expand Compound Files' option do during evidence processing?