ACE ACE File System & Artifact Analysis

Question 1

What primary structure does NTFS use to track every file and directory on a volume?

Accepted Answer

Master File Table (MFT)

Answer

NTFS uses the Master File Table (MFT) as the primary structure for recording metadata about every file and directory on the volume.

Question 2

In FTK, what does the 'Bookmarks' feature allow an examiner to do?

Accepted Answer

Tag and annotate specific evidence items for later reference

Answer

FTK's Bookmarks feature lets examiners flag and annotate items of interest for organized review and inclusion in reports.

Question 3

Which MAC timestamp records the last time a file's content was changed in NTFS?

Accepted Answer

Modified time

Answer

The Modified timestamp in NTFS records the last time the file's data content was written or changed.

Question 4

What is 'file carving' in digital forensics?

Accepted Answer

Recovering files based on file signatures without relying on file system metadata

Answer

File carving recovers files by identifying known file headers and footers in raw data when file system metadata is missing or overwritten.

Question 5

In FTK, what does the 'Evidence Tree' panel display?

Accepted Answer

A hierarchical view of all added evidence sources and their file system contents

Answer

FTK's Evidence Tree provides a hierarchical navigation view of all added evidence items, mirroring the folder structure found within each source.

(ACE) AccessData Certified Examiner Practice Test