AccessData ACE Certification test

FTK Imager can read a Norton Ghost Compressed Image file - answer-False FTK Imager can image individual files - answer-False FTK Imager can read a Norton Ghost Uncompressed File - answer-True FTK Imager is a write blocking device/software - answer-False. (It will not directly write to a suspect device but windows may) Using FTK Imager, if you convert and EO1 to Raw (or vis versa), the Hashes would match. - answer-True Name 3 image file types that allow compression. - answer-E01, S01, AD01 Why would FTK imager indicate drive numbers, 1,2,3, and 5? - answer-5 and above indicates an extended partition. 1-4 indicates Primary partitions. When exporting a file from Imager, the time and date stamps of the exported file will not match those of the file in the original image. - answer-False. Imager will use the original times and dates for the file it exports. When you export a file hashlist from Imager, the files go out into a plain text file. - answer-False. They go into a CSV (comma separated values) file. What function would you use in FTK Imager to automatically grab commonly used files from the registry? - answer-Obtain Protected Files FTK Imager can hash or image files that are in use by the operating system. - answer-True. In PRTK which type of attack uses word lists? - answer-Dictionary Attack Name three attack types in PRTK - answer-Decryption, Keyspace, Password Reset. Where can a user determine what type of attacks can be run on a file. - answer-Help -> Recovery Module What is the most successful method for password recovery. - answer-AD Decryption. (Instant) What 3 parts comprise an attack profile? - answer-Languages, Dictionaries, Levels. What happens to a file's hash value when it is decrypted - answer-It changes. How would you view all the graphics in a case in FTK - answer-Select the root of the evdence tree and enable the quick picks for it.