ADC Data Analysis & Statistical Methods Flashcards

What statistical measure helps determine if a file's actual size differs significantly from its logical size in FTK?

Answer: Slack space analysis

Slack space is the unused area between a file's logical end and the end of its last allocated cluster, which may contain remnants of previously deleted data.

How does FTK's column statistics feature assist in data analysis?

Answer: It provides aggregate counts and summaries of metadata fields across all evidence items

Column statistics aggregate values like file sizes and dates across the entire evidence set, enabling examiners to spot outliers and data distributions quickly.

In digital forensic analysis, what does 'timeline analysis' in FTK help reconstruct?

Answer: The chronological sequence of system and user activities

Timeline analysis merges timestamps from file system metadata, registry entries, and logs into a single chronological view of what occurred on a system.

What does the FTK 'overview' tab's file category breakdown provide to investigators?

Answer: A statistical summary of file types found in the evidence, aiding in prioritization

The overview tab categorizes all evidence by file type with counts, letting examiners immediately navigate to the most relevant category for the case.

Which AccessData feature allows investigators to filter evidence by file date ranges for focused analysis?

Answer: Date/time filter in the evidence tree or search options

FTK's date/time filters restrict the evidence view to a specific window, letting examiners focus on activity that occurred during a known incident period.

What does the term 'logical acquisition' mean in the context of AccessData FTK evidence collection?

Answer: Imaging only the active file system and allocated files rather than the full disk

A logical acquisition copies only the files visible to the operating system, making it faster than a physical image but potentially missing deleted or unallocated data.