ACI ACI FTK Toolkit & Investigation Workflow

Question 1

In AccessData FTK, what does the 'Expand Compound Files' option do during evidence processing?

Accepted Answer

Extracts and indexes content from ZIP, PST, and other container files

Answer

Increases the file size limit for imports

Answer

Decompresses the forensic image file itself

Answer

Converts evidence to a different format

Question 2

What is the purpose of the 'Case Log' in an FTK investigation?

Accepted Answer

To record all investigative actions and maintain an audit trail

Answer

To store the forensic image backup

Answer

To list all suspect IP addresses

Answer

To generate the final court report automatically

Question 3

Which FTK processing option helps recover deleted files by examining unallocated disk space?

Accepted Answer

Data Carving

Answer

Index Search Terms

Answer

Hash Analysis

Answer

File Signature Verification

Question 4

When using FTK Imager to acquire evidence, what does selecting the 'Verify images after they are created' option accomplish?

Accepted Answer

It hashes the source and image to confirm the copy is bit-for-bit identical

Answer

It encrypts the image for secure transport

Answer

It automatically uploads the image to a cloud server

Answer

It scans the image for viruses

Question 5

In FTK, what does 'file signature analysis' reveal about a file?

Accepted Answer

Whether the file's actual format matches its extension, potentially indicating disguised files

Answer

The file's digital signature certificate

Answer

The author's electronic signature

Answer

The file's encryption algorithm

Question 6

What is the primary advantage of using FTK's database-driven architecture compared to older forensic tools?

Accepted Answer

It allows multiple investigators to simultaneously access and work on the same case

Answer

It requires no hard drive space

Answer

It eliminates the need for write blockers

Answer

It automatically generates court-admissible reports