Tool Proficiency & Analysis Techniques Flashcards
7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Tool Proficiency & Analysis Techniques flashcards as text
An examiner uses FTK to examine a TrueCrypt/VeraCrypt volume. Which analysis approach is MOST appropriate when the passphrase is unknown?
Answer: Attempt password recovery with PRTK/DNA against the volume header, or seek a keyfile/passphrase from other evidence
Without a known passphrase, the examiner should use PRTK/DNA for password recovery against the volume header or search other evidence sources for the passphrase or keyfile.
In FTK, the 'File Status' column shows a file marked as 'Duplicate.' What is the forensic significance of this designation?
Answer: The file's hash exactly matches another file already found in the case, indicating identical content
A 'Duplicate' designation means FTK found another file in the case with an identical hash, indicating the same content exists in multiple locations.
When using FTK's 'Explicit Images' analysis on a case, what additional step must an examiner take to ensure findings are court-admissible?
Answer: Personally review and confirm each flagged image, as automated scoring alone is not sufficient
Automated explicit image detection aids triage but the examiner must personally review and confirm each flagged image to provide admissible testimony about the content.
Which FTK processing option, when enabled before case ingestion, allows the examiner to see files stored inside compressed archives like ZIP and RAR as if they were separate items?
Answer: Expand Compound Files
The 'Expand Compound Files' option causes FTK to extract and individually index files contained within archives, email containers, and other compound file types.
An ACE examiner finds a file with a creation timestamp that is LATER than its last modified timestamp. What is the MOST likely explanation?
Answer: The file was copied to this location after it was originally created and modified elsewhere
When a file is copied to a new location, Windows updates the creation timestamp to the copy time, which can make it later than the original modification timestamp from the source.
During FTK analysis, an examiner needs to search for a specific pattern across all files, including inside email attachments and ZIP archives. Which search type is MOST appropriate?
Answer: Index search (dtSearch) after processing with Expand Compound Files enabled
An index search using dtSearch, combined with the Expand Compound Files processing option, allows full-text searching inside emails, attachments, and compressed archives.
What is the purpose of FTK's 'Case Log' feature during an investigation?
Answer: To maintain an auditable record of examiner actions, searches, and findings within the case
The Case Log records examiner actions, searches performed, and notes within FTK, providing an auditable trail that supports testimony about the examination methodology.