ACE Password Recovery & Decryption 1 — Questions and Answers
Question 1: Which AccessData tool is specifically designed for password recovery and works in conjunction with FTK?
- PRTK (Password Recovery Toolkit) (Correct answer)
- MPE+ (Mobile Phone Examiner Plus)
- AD Lab
- Cerberus
Correct answer: PRTK (Password Recovery Toolkit)
PRTK (Password Recovery Toolkit) is AccessData's dedicated password recovery tool that integrates with FTK to recover passwords from protected files.
Question 2: What is AccessData's DNA (Distributed Network Attack) feature primarily used for?
- Distributing password cracking workloads across networked computers (Correct answer)
- Analyzing network traffic captures
- Decrypting SSL/TLS communications
- Managing distributed forensic case files
Correct answer: Distributing password cracking workloads across networked computers
DNA leverages multiple networked machines to parallelize and accelerate password recovery operations, dramatically reducing cracking time.
Question 3: In a dictionary attack, what is the primary source material used to attempt password recovery?
- A predefined list of common words and phrases (Correct answer)
- All possible character combinations up to a set length
- Previously known plaintext-ciphertext pairs
- Precomputed hash values stored in tables
Correct answer: A predefined list of common words and phrases
A dictionary attack uses a wordlist of common passwords, words, or phrases as candidates, making it effective against weak or common passwords.
Question 4: What type of password attack attempts every possible combination of characters up to a specified length?
- Brute force attack (Correct answer)
- Dictionary attack
- Rule-based attack
- Rainbow table attack
Correct answer: Brute force attack
A brute force attack systematically tries all possible character combinations, guaranteeing eventual success but requiring significant time and resources.
Question 5: What is a rainbow table in the context of password cracking?
- A precomputed table of hash values mapped to their plaintext passwords (Correct answer)
- A color-coded matrix for organizing password complexity rules
- A list of leaked passwords sorted by frequency
- A GUI tool for visualizing password entropy
Correct answer: A precomputed table of hash values mapped to their plaintext passwords
Rainbow tables store precomputed hash-to-plaintext mappings, enabling fast password recovery by looking up a hash rather than computing it in real time.
Question 6: What security mechanism makes rainbow table attacks significantly less effective?
- Salting the password before hashing (Correct answer)
- Using a longer hashing algorithm
- Encrypting the hash output
- Storing passwords in base64 encoding
Correct answer: Salting the password before hashing
Salting adds a unique random value to each password before hashing, ensuring identical passwords produce different hashes and invalidating precomputed rainbow tables.
Question 7: When FTK identifies an encrypted file during processing, what is the recommended first step before attempting password recovery?
- Check if the password or key material exists elsewhere in the image (e.g., swap file, registry) (Correct answer)
- Immediately begin a brute force attack
- Export the file and use a third-party tool
- Mark the file as inaccessible and note it in the report
Correct answer: Check if the password or key material exists elsewhere in the image (e.g., swap file, registry)
Key material, passwords, or encryption artifacts may exist in other areas of the image such as unallocated space, the registry, or hibernation/swap files, providing a faster path than cracking.
ACE Password Recovery & Decryption 1
Which AccessData tool is specifically designed for password recovery and works in conjunction with FTK?