ACE ACE File System & Artifact Analysis 1 — Questions and Answers
Question 1: What primary structure does NTFS use to track every file and directory on a volume?
- FAT32 allocation table
- Master File Table (MFT) (Correct answer)
- inode table
- File Allocation Table
Correct answer: Master File Table (MFT)
NTFS uses the Master File Table (MFT) as the primary structure for recording metadata about every file and directory on the volume.
Question 2: In FTK, what does the 'Bookmarks' feature allow an examiner to do?
- Filter evidence by file type
- Tag and annotate specific evidence items for later reference (Correct answer)
- Run hash verification on all files
- Export all evidence to a folder
Correct answer: Tag and annotate specific evidence items for later reference
FTK's Bookmarks feature lets examiners flag and annotate items of interest for organized review and inclusion in reports.
Question 3: Which MAC timestamp records the last time a file's content was changed in NTFS?
- Accessed time
- Created time
- Modified time (Correct answer)
- Entry Modified time
Correct answer: Modified time
The Modified timestamp in NTFS records the last time the file's data content was written or changed.
Question 4: What is 'file carving' in digital forensics?
- Encrypting recovered files for secure storage
- Recovering files based on file signatures without relying on file system metadata (Correct answer)
- Hashing all files on a drive for verification
- Securely wiping files from a disk
Correct answer: Recovering files based on file signatures without relying on file system metadata
File carving recovers files by identifying known file headers and footers in raw data when file system metadata is missing or overwritten.
Question 5: In FTK, what does the 'Evidence Tree' panel display?
- Hash values of all indexed files
- A hierarchical view of all added evidence sources and their file system contents (Correct answer)
- Only deleted and unallocated files
- Email headers extracted from the image
Correct answer: A hierarchical view of all added evidence sources and their file system contents
FTK's Evidence Tree provides a hierarchical navigation view of all added evidence items, mirroring the folder structure found within each source.
Question 6: What is 'slack space' in digital forensics?
- Unpartitioned space at the end of a disk
- The unused area between the logical end of a file and the physical end of its last allocated cluster (Correct answer)
- Free space available for new file creation
- Space reserved for the MFT expansion zone
Correct answer: The unused area between the logical end of a file and the physical end of its last allocated cluster
Slack space is the residual area from where a file's data ends to the physical boundary of the last allocated storage cluster, which can contain remnants of previous data.
ACE ACE File System & Artifact Analysis 1
What primary structure does NTFS use to track every file and directory on a volume?