ADC ADC Data Analysis & Statistical Methods 1 — Questions and Answers
Question 1: What is the primary purpose of hash value analysis in AccessData FTK?
- To compress file storage
- To verify file integrity and identify known files (Correct answer)
- To encrypt sensitive data
- To speed up indexing
Correct answer: To verify file integrity and identify known files
Hash values like MD5 and SHA-1 uniquely fingerprint files, allowing examiners to verify that evidence has not been altered and to match files against known hash sets.
Question 2: Which method in FTK identifies files that have been intentionally renamed to hide their true type?
- Timestamp normalization
- File signature vs. extension mismatch detection (Correct answer)
- Entropy thresholding
- Hash set filtering
Correct answer: File signature vs. extension mismatch detection
FTK compares the file's internal signature (magic bytes) against its extension, flagging mismatches that indicate deliberate obfuscation.
Question 3: What does 'data carving' refer to in digital forensics with AccessData?
- Encrypting recovered data
- Recovering files from unallocated disk space based on file signatures (Correct answer)
- Partitioning hard drives
- Compressing forensic images
Correct answer: Recovering files from unallocated disk space based on file signatures
Data carving reconstructs files from raw disk sectors by locating known file headers and footers, even without a valid file system entry.
Question 4: What is the analytical value of examining MFT (Master File Table) records in FTK?
- They store browser history
- They contain detailed metadata including file creation, modification, and access timestamps (Correct answer)
- They list installed programs
- They record network connections
Correct answer: They contain detailed metadata including file creation, modification, and access timestamps
The NTFS MFT stores a record for every file including MAC (Modified, Accessed, Created) timestamps that are critical for timeline reconstruction.
Question 5: What type of analysis examines patterns in file access times within AccessData tools?
- Spectral analysis
- Temporal forensic analysis (Correct answer)
- Regression modeling
- Bayesian inference
Correct answer: Temporal forensic analysis
Temporal forensic analysis correlates file timestamps across the evidence set to reconstruct the chronological sequence of user and system activity.
Question 6: Which FTK feature helps analysts identify duplicate files across an evidence set?
- File carver
- MD5/SHA hash comparison (Correct answer)
- Keyword indexer
- Registry viewer
Correct answer: MD5/SHA hash comparison
FTK computes hash values for every file and groups identical hashes together, enabling rapid deduplication and identification of copied files.
ADC ADC Data Analysis & Statistical Methods 1
What is the primary purpose of hash value analysis in AccessData FTK?