ACI ACI FTK Toolkit & Investigation Workflow 1

Question 1

In AccessData FTK, what does the 'Expand Compound Files' option do during evidence processing?

Accepted Answer

Extracts and indexes content from ZIP, PST, and other container files

Answer

Expanding compound files causes FTK to extract and index the contents of archives, email stores, and other container formats for analysis.

Question 2

What is the purpose of the 'Case Log' in an FTK investigation?

Accepted Answer

To record all investigative actions and maintain an audit trail

Answer

The FTK Case Log maintains a timestamped record of all analyst actions within a case, supporting chain of custody and audit requirements.

Question 3

Which FTK processing option helps recover deleted files by examining unallocated disk space?

Accepted Answer

Data Carving

Answer

Data carving scans unallocated space for file headers and footers to reconstruct deleted or fragmented files without relying on file system metadata.

Question 4

When using FTK Imager to acquire evidence, what does selecting the 'Verify images after they are created' option accomplish?

Accepted Answer

It hashes the source and image to confirm the copy is bit-for-bit identical

Answer

Post-acquisition verification hashes both the source drive and the resulting image to confirm forensic integrity and that no data was altered during imaging.

Question 5

In FTK, what does 'file signature analysis' reveal about a file?

Accepted Answer

Whether the file's actual format matches its extension, potentially indicating disguised files

Answer

File signature analysis compares the file header magic bytes against known signatures to detect files whose extensions have been changed to hide their true type.

(ACI) AccessData Certified Investigator Practice Test

(ACI) AccessData Certified Investigator Practice Test

ACI ACI FTK Toolkit & Investigation Workflow 1