ADC ADC Data Analysis & Statistical Methods 1

Question 1

What is the primary purpose of hash value analysis in AccessData FTK?

Accepted Answer

To verify file integrity and identify known files

Answer

Hash values like MD5 and SHA-1 uniquely fingerprint files, allowing examiners to verify that evidence has not been altered and to match files against known hash sets.

Question 2

Which method in FTK identifies files that have been intentionally renamed to hide their true type?

Accepted Answer

File signature vs. extension mismatch detection

Answer

FTK compares the file's internal signature (magic bytes) against its extension, flagging mismatches that indicate deliberate obfuscation.

Question 3

What does 'data carving' refer to in digital forensics with AccessData?

Accepted Answer

Recovering files from unallocated disk space based on file signatures

Answer

Data carving reconstructs files from raw disk sectors by locating known file headers and footers, even without a valid file system entry.

Question 4

What is the analytical value of examining MFT (Master File Table) records in FTK?

Accepted Answer

They contain detailed metadata including file creation, modification, and access timestamps

Answer

The NTFS MFT stores a record for every file including MAC (Modified, Accessed, Created) timestamps that are critical for timeline reconstruction.

Question 5

What type of analysis examines patterns in file access times within AccessData tools?

Accepted Answer

Temporal forensic analysis

Answer

Temporal forensic analysis correlates file timestamps across the evidence set to reconstruct the chronological sequence of user and system activity.

ADC - Access Data Certification Practice Test

ADC - Access Data Certification Practice Test

ADC ADC Data Analysis & Statistical Methods 1