ADC ADC Data Analysis & Statistical Methods 2

Question 1

What is the significance of entropy analysis in FTK examinations?

Accepted Answer

High entropy values may indicate encrypted or compressed data

Answer

High Shannon entropy means data bytes are distributed nearly randomly, a hallmark of encryption or compression that warrants further investigation.

Question 2

In AccessData FTK, what does 'bookmarking' evidence items enable?

Accepted Answer

Organizing and annotating relevant evidence for reporting

Answer

Bookmarks allow examiners to tag significant evidence items with annotations that are then exported directly into the final case report.

Question 3

What statistical output does the FTK case summary report provide?

Accepted Answer

Counts of file types, sizes, and evidence items processed

Answer

The FTK case summary report gives totals for each evidence category — documents, images, email, etc. — helping examiners prioritize their review.

Question 4

What does 'cluster analysis' of file system data help investigators determine?

Accepted Answer

Groupings of related files or activity patterns based on metadata similarities

Answer

Cluster analysis groups files sharing similar metadata characteristics — dates, authors, sizes — revealing patterns of coordinated activity or data staging.

Question 5

In FTK, what is the purpose of applying known file hash sets (NSRL)?

Accepted Answer

To filter out known good operating system files and focus on relevant evidence

Answer

The NIST National Software Reference Library (NSRL) contains hashes of known legitimate OS and application files, allowing FTK to exclude them from review.

ADC - Access Data Certification Practice Test

ADC - Access Data Certification Practice Test

ADC ADC Data Analysis & Statistical Methods 2