Tool Proficiency & Analysis Techniques Flashcards
7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Tool Proficiency & Analysis Techniques flashcards as text
In FTK, what is the purpose of creating a 'bookmark' during an examination?
Answer: To tag and organize items of evidentiary interest for inclusion in reports
Bookmarks in FTK allow examiners to tag and group items of evidentiary interest, which can then be organized and included in case reports.
An examiner is reviewing LNK (shortcut) files in FTK to track recently accessed documents. Which artifact within a LNK file is MOST valuable for this purpose?
Answer: The target file's MAC timestamps, volume serial number, and original path embedded in the LNK
LNK files embed the target file's MAC timestamps, volume information, and original path, providing evidence of when and where a document was accessed even if the original is deleted.
When examining a suspect's system using FTK, the examiner finds the Prefetch folder contains .pf files. What does the presence of a Prefetch file for a specific application prove?
Answer: The application was executed at least once on the system
The existence of a Prefetch file for an application proves that the application was executed at least once on that Windows system.
An ACE examiner needs to analyze an iPhone backup stored on a Windows PC. Which FTK capability would assist in parsing the iTunes backup structure?
Answer: FTK's ability to index and parse the iTunes backup manifest database (Manifest.db)
FTK can index and parse the SQLite Manifest.db and individual backup files from iTunes/Finder backups stored on the computer being examined.
Which Windows artifact, when analyzed in FTK, can reveal the last time a removable USB storage device was connected to a suspect's machine?
Answer: USBSTOR registry key entries with associated setupapi.dev.log timestamps
The USBSTOR registry key records connected USB storage devices, and correlating with setupapi.dev.log provides installation timestamps for first connection times.
In FTK's visualization features, what does the 'Geolocation' map view primarily display?
Answer: GPS coordinates extracted from EXIF metadata in image files plotted on a map
FTK's Geolocation feature extracts GPS EXIF coordinates from photos and plots them on a map to show where images were taken.
When recovering deleted files from an NTFS volume in FTK, what happens to a file's data when its MFT entry is marked as unallocated but the clusters are not yet overwritten?
Answer: The file's content remains in the original clusters and may be recoverable
When an NTFS file is deleted, its MFT entry is marked unallocated but the actual data clusters are not immediately wiped, leaving content recoverable until overwritten.