ADC Data Analysis & Statistical Methods Flashcards
6 cards from real ADC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 ADC Data Analysis & Statistical Methods flashcards as text
What is the significance of entropy analysis in FTK examinations?
Answer: High entropy values may indicate encrypted or compressed data
High Shannon entropy means data bytes are distributed nearly randomly, a hallmark of encryption or compression that warrants further investigation.
In AccessData FTK, what does 'bookmarking' evidence items enable?
Answer: Organizing and annotating relevant evidence for reporting
Bookmarks allow examiners to tag significant evidence items with annotations that are then exported directly into the final case report.
What statistical output does the FTK case summary report provide?
Answer: Counts of file types, sizes, and evidence items processed
The FTK case summary report gives totals for each evidence category — documents, images, email, etc. — helping examiners prioritize their review.
What does 'cluster analysis' of file system data help investigators determine?
Answer: Groupings of related files or activity patterns based on metadata similarities
Cluster analysis groups files sharing similar metadata characteristics — dates, authors, sizes — revealing patterns of coordinated activity or data staging.
In FTK, what is the purpose of applying known file hash sets (NSRL)?
Answer: To filter out known good operating system files and focus on relevant evidence
The NIST National Software Reference Library (NSRL) contains hashes of known legitimate OS and application files, allowing FTK to exclude them from review.
In FTK, what is the purpose of keyword search statistics?
Answer: To quantify occurrences and locations of specific terms across the evidence set
Keyword hit statistics show how many files contain a search term and in which locations, helping examiners assess relevance and scope.