ACE Password Recovery & Decryption 2 — Questions and Answers
Question 1: What is a rule-based (or hybrid) attack in PRTK?
- Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates (Correct answer)
- Combining two dictionary files into a single wordlist
- Using known plaintext to derive the encryption key
- Splitting a brute force attack across multiple processors
Correct answer: Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates
A rule-based attack applies mutations — such as capitalization, substitution, or appending digits — to dictionary entries to cover predictable password patterns.
Question 2: Windows EFS (Encrypting File System) stores decryption key material in which location?
- The user's certificate store tied to their Windows account credentials (Correct answer)
- A hidden system file at the root of the volume
- The BIOS firmware chip
- A dedicated hardware security module
Correct answer: The user's certificate store tied to their Windows account credentials
EFS uses the user's private key stored in their certificate store; if the examiner can log in as the user or export the certificate, EFS-protected files can be decrypted.
Question 3: When examining a BitLocker-encrypted drive, which of the following is the most examiner-friendly recovery method if the recovery key is unavailable?
- Searching the Microsoft account or Active Directory for the stored BitLocker Recovery Key (Correct answer)
- Running a GPU-accelerated brute force attack against the volume header
- Imaging the encrypted volume and processing it directly in FTK
- Disabling BitLocker through the Windows RE environment
Correct answer: Searching the Microsoft account or Active Directory for the stored BitLocker Recovery Key
BitLocker recovery keys are automatically backed up to Microsoft accounts or Active Directory, making this the fastest and most reliable recovery path for examiners.
Question 4: GPU acceleration in password cracking provides a significant advantage primarily because GPUs:
- Contain thousands of cores optimized for parallel mathematical operations (Correct answer)
- Have faster memory access than CPUs
- Can store more dictionary entries in cache
- Operate at higher clock speeds than modern CPUs
Correct answer: Contain thousands of cores optimized for parallel mathematical operations
GPUs contain thousands of small cores designed for parallel processing, allowing them to compute millions of hash comparisons simultaneously — far exceeding CPU performance for cracking tasks.
Question 5: What does FTK's 'Known File Filter' (KFF) contribute to a password recovery workflow?
- It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files (Correct answer)
- It automatically decrypts files that match known encryption signatures
- It identifies files that have been renamed to hide their extension
- It flags files whose hash matches known malware databases
Correct answer: It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files
KFF filters out known-good files (e.g., OS and application files), reducing the dataset so examiners concentrate password recovery efforts on genuinely unknown, potentially relevant encrypted files.
Question 6: A suspect's password-protected ZIP archive uses PKZIP 2.0 (ZipCrypto) encryption. Why is this considered weak from a forensic perspective?
- ZipCrypto is vulnerable to known-plaintext attacks that can recover the key with as little as 12 bytes of known plaintext (Correct answer)
- ZipCrypto uses only 40-bit keys that brute force attacks can break instantly
- PKZIP 2.0 stores the password hash in the ZIP header in plaintext
- ZipCrypto archives can be decompressed without a password using standard tools
Correct answer: ZipCrypto is vulnerable to known-plaintext attacks that can recover the key with as little as 12 bytes of known plaintext
The ZipCrypto algorithm is vulnerable to a known-plaintext attack; if an examiner has an unencrypted copy of even one file in the archive, the encryption key can be recovered rapidly.
Question 7: In FTK, when a file is flagged as 'encrypted' after processing, what does this determination typically rely on?
- File header signatures, entropy analysis, and known encryption format identification (Correct answer)
- The file extension matching a known encrypted format list
- The file owner's account being marked as restricted
- The file being located in a system-protected directory
Correct answer: File header signatures, entropy analysis, and known encryption format identification
FTK combines file signature recognition, known encryption format headers, and high-entropy measurements to identify encrypted files, rather than relying solely on extensions.
ACE Password Recovery & Decryption 2
What is a rule-based (or hybrid) attack in PRTK?