ADC ADC Data Analysis & Statistical Methods 2 — Questions and Answers
Question 1: What is the significance of entropy analysis in FTK examinations?
- Low entropy indicates large files
- High entropy values may indicate encrypted or compressed data (Correct answer)
- Entropy measures network speed
- Entropy determines file age
Correct answer: High entropy values may indicate encrypted or compressed data
High Shannon entropy means data bytes are distributed nearly randomly, a hallmark of encryption or compression that warrants further investigation.
Question 2: In AccessData FTK, what does 'bookmarking' evidence items enable?
- Permanently deleting files
- Organizing and annotating relevant evidence for reporting (Correct answer)
- Encrypting case files
- Compressing the forensic image
Correct answer: Organizing and annotating relevant evidence for reporting
Bookmarks allow examiners to tag significant evidence items with annotations that are then exported directly into the final case report.
Question 3: What statistical output does the FTK case summary report provide?
- Network packet statistics
- Counts of file types, sizes, and evidence items processed (Correct answer)
- Database query performance metrics
- Server uptime percentages
Correct answer: Counts of file types, sizes, and evidence items processed
The FTK case summary report gives totals for each evidence category — documents, images, email, etc. — helping examiners prioritize their review.
Question 4: What does 'cluster analysis' of file system data help investigators determine?
- Physical hard drive health
- Groupings of related files or activity patterns based on metadata similarities (Correct answer)
- Network bandwidth usage
- BIOS configuration settings
Correct answer: Groupings of related files or activity patterns based on metadata similarities
Cluster analysis groups files sharing similar metadata characteristics — dates, authors, sizes — revealing patterns of coordinated activity or data staging.
Question 5: In FTK, what is the purpose of applying known file hash sets (NSRL)?
- To recover deleted files
- To filter out known good operating system files and focus on relevant evidence (Correct answer)
- To index email attachments
- To decrypt protected archives
Correct answer: To filter out known good operating system files and focus on relevant evidence
The NIST National Software Reference Library (NSRL) contains hashes of known legitimate OS and application files, allowing FTK to exclude them from review.
Question 6: In FTK, what is the purpose of keyword search statistics?
- To delete irrelevant files
- To quantify occurrences and locations of specific terms across the evidence set (Correct answer)
- To generate encryption keys
- To map network topology
Correct answer: To quantify occurrences and locations of specific terms across the evidence set
Keyword hit statistics show how many files contain a search term and in which locations, helping examiners assess relevance and scope.
ADC ADC Data Analysis & Statistical Methods 2
What is the significance of entropy analysis in FTK examinations?