AccessData Certified Examiner (ACE) — Questions and Answers

Question 1: What is the purpose of using a Faraday bag during mobile device acquisition?

Block wireless signals to prevent remote wipe commands (Correct answer)
Prevent electrostatic discharge from damaging the device
Keep the device charged during transport
Compress file system data for storage

Correct answer: Block wireless signals to prevent remote wipe commands

A Faraday bag blocks cellular, Wi-Fi, and Bluetooth signals, preventing remote wipe or data modification commands from reaching the device.

Question 2: When FTK identifies an encrypted file during processing, what is the recommended first step before attempting password recovery?

Immediately begin a brute force attack
Check if the password or key material exists elsewhere in the image (e.g., swap file, registry) (Correct answer)
Export the file and use a third-party tool
Mark the file as inaccessible and note it in the report

Correct answer: Check if the password or key material exists elsewhere in the image (e.g., swap file, registry)

Key material, passwords, or encryption artifacts may exist in other areas of the image such as unallocated space, the registry, or hibernation/swap files, providing a faster path than cracking.

Question 3: In AccessData's Password Recovery Toolkit (PRTK), what is a 'dictionary attack with rules' primarily designed to do?

Replay authentication tokens captured from network traffic
Test every possible character combination up to a set length
Use previously cracked passwords from other cases as the wordlist
Apply transformations like capitalization and number substitution to dictionary words (Correct answer)

Correct answer: Apply transformations like capitalization and number substitution to dictionary words

Dictionary attacks with rules apply mutation rules (capitalization, leet-speak, appended numbers) to base dictionary words to crack common password patterns.

Question 4: What type of traffic does a packet sniffer capture during network forensic analysis?

Exclusively DNS query and response messages
Raw network packets traversing the monitored network interface (Correct answer)
Only HTTPS-encrypted web traffic streams
Only wireless beacon and management frames

Correct answer: Raw network packets traversing the monitored network interface

A packet sniffer captures all raw packets at the network interface level, providing complete visibility into communications regardless of protocol.

Question 5: Which Windows registry location stores previously connected wireless (Wi-Fi) network profiles?

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and WLAN event logs (Correct answer)
HKLM\SAM\SAM\Domains\Account\Users
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

Correct answer: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and WLAN event logs

Windows stores Wi-Fi network history in the NetworkList registry key and WLAN AutoConfig event logs, which can reveal location history based on network associations.

Question 6: What is the primary purpose of maintaining a detailed chain of custody log for digital evidence?

To comply with HIPAA data handling requirements
To document every person who accessed the evidence and when, ensuring integrity and admissibility (Correct answer)
To track software license usage during the investigation
To satisfy IRS audit requirements for forensic service fees

Correct answer: To document every person who accessed the evidence and when, ensuring integrity and admissibility

Chain of custody documentation ensures that evidence integrity can be verified and that admissibility challenges related to tampering can be defended.

Question 7: When recovering passwords for Microsoft Office documents (.docx, .xlsx) protected with AES-256 encryption (Office 2016+), what approach is most realistic for an examiner?

Extracting the password from the document's XML metadata
Dictionary or rule-based attacks combined with GPU acceleration, since AES-256 itself is not feasibly broken (Correct answer)
Directly decrypting the file using FTK's Office decryption engine
Using a known-plaintext attack against the Office encryption format

Correct answer: Dictionary or rule-based attacks combined with GPU acceleration, since AES-256 itself is not feasibly broken

Modern Office encryption using AES-256 is cryptographically strong; examiners rely on password-guessing attacks (dictionary, rules, GPU-assisted) rather than breaking the encryption algorithm itself.

Question 8: A fitness director asks trainers to track client dropout rates by program type. This data collection effort PRIMARILY aims to:

Identify which programs need marketing improvements
Calculate trainer commissions based on client retention
Pinpoint program weaknesses contributing to client attrition (Correct answer)
Satisfy ACE accreditation reporting requirements

Correct answer: Pinpoint program weaknesses contributing to client attrition

Tracking dropout rates by program type is a quality assurance strategy to identify which programs may be ineffective, inaccessible, or misaligned with client needs.

Question 9: In FTK, what is the purpose of the 'Detailed Options' hash verification step during evidence processing?

To compress evidence files before storage
To automatically redact sensitive data from the evidence set
To compute and record cryptographic hash values (MD5/SHA-1) of evidence items to verify integrity throughout the investigation (Correct answer)
To index only image files while skipping documents

Correct answer: To compute and record cryptographic hash values (MD5/SHA-1) of evidence items to verify integrity throughout the investigation

FTK computes MD5 and SHA-1 hashes during evidence processing to create a verifiable integrity baseline, confirming that evidence has not been altered.

Question 10: In FTK Imager, what format produces a single-file image with integrated hashing, compression, and case metadata?

DD (raw)
ISO 9660
E01 (Expert Witness Format) (Correct answer)
AFF (Advanced Forensic Format)

Correct answer: E01 (Expert Witness Format)

E01 format embeds MD5/SHA-1 hashes, case metadata, and optional compression within a single segmented or monolithic file.

Question 11: An examiner receives a hard drive with a damaged partition table. Which FTK Imager feature allows imaging despite this condition?

Create Disk Image with custom sector range (Correct answer)
Add Evidence Item → Physical Drive
Verify Drive/Image
Mount Image to Drive Letter

Correct answer: Create Disk Image with custom sector range

Specifying a custom sector range lets the examiner image readable sectors even when the partition table is corrupt or missing.

Question 12: The Computer Fraud and Abuse Act (CFAA) 18 U.S.C. § 1030 prohibits unauthorized access to protected computers. Which element is most critical to establishing a CFAA violation?

Access must have been 'without authorization' or 'exceeding authorized access' (Correct answer)
The defendant must have caused more than $500 in damages
The crime must cross state lines to be federal
The defendant must have used encryption to conceal the intrusion

Correct answer: Access must have been 'without authorization' or 'exceeding authorized access'

The core element of a CFAA violation is accessing a protected computer 'without authorization' or by 'exceeding authorized access,' making this the threshold issue in any CFAA case.

Question 13: What is the importance of staying current with trends in Advanced Techniques & Methods for ACORD Certified Expert?

Trends do not affect professional practice
It is not necessary once certified
It ensures practices remain effective and relevant (Correct answer)
It is only required for new professionals

Correct answer: It ensures practices remain effective and relevant

Staying current with industry trends ensures that professional practices remain effective, relevant, and aligned with evolving standards.

Question 14: Which FTK Imager feature is used to acquire a live memory dump from a running Windows system?

Create Disk Image
Capture Memory (Correct answer)
Add Evidence Item
Mount Image to Drive Letter

Correct answer: Capture Memory

FTK Imager's 'Capture Memory' option acquires the contents of RAM from a running system and writes it to a .mem or .dmp file for offline analysis.

Question 15: What is the significance of the MD5 hash value in digital forensics?

It provides a unique fingerprint to verify a file or image has not been altered (Correct answer)
It compresses evidence files for storage
It encrypts evidence to prevent unauthorized access
It identifies the operating system on the evidence drive

Correct answer: It provides a unique fingerprint to verify a file or image has not been altered

MD5 produces a fixed-length digest that acts as a fingerprint; any change to the data produces a different hash, verifying integrity.

Question 16: When using FTK Imager's 'Capture Memory' function, what type of file is created that an examiner would later load into a memory analysis tool?

A raw .mem or .dmp memory dump file (Correct answer)
An E01 EnCase evidence file
A hibernation file (hiberfil.sys) clone
A .vmem virtual machine memory snapshot

Correct answer: A raw .mem or .dmp memory dump file

FTK Imager's Capture Memory function creates a raw memory dump file (.mem or .dmp) containing the full contents of physical RAM at capture time.

Question 17: What is the primary forensic value of Windows Event Logs?

They provide a chronological record of system events including logons, service starts, and security actions (Correct answer)
They record every keystroke entered by users
They contain the full content of deleted files
They store a copy of all files created on the system

Correct answer: They provide a chronological record of system events including logons, service starts, and security actions

Windows Event Logs (Security, System, Application) record timestamped system events that enable forensic reconstruction of activity timelines.

Question 18: Why should forensic images always be stored on media separate from the examiner's working copy?

To preserve the original evidence image unaltered while analysis is done on the copy (Correct answer)
To save storage space through deduplication
To comply with NTFS file size limitations
To speed up hash verification

Correct answer: To preserve the original evidence image unaltered while analysis is done on the copy

Keeping the original image untouched ensures that evidence integrity is maintained and the original can be re-examined if the working copy is corrupted.

Question 19: What does FTK's 'Known File Filter' (KFF) contribute to a password recovery workflow?

It flags files whose hash matches known malware databases
It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files (Correct answer)
It identifies files that have been renamed to hide their extension
It automatically decrypts files that match known encryption signatures

Correct answer: It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files

KFF filters out known-good files (e.g., OS and application files), reducing the dataset so examiners concentrate password recovery efforts on genuinely unknown, potentially relevant encrypted files.

Question 20: In a dictionary attack, what is the primary source material used to attempt password recovery?

Precomputed hash values stored in tables
All possible character combinations up to a set length
A predefined list of common words and phrases (Correct answer)
Previously known plaintext-ciphertext pairs

Correct answer: A predefined list of common words and phrases

A dictionary attack uses a wordlist of common passwords, words, or phrases as candidates, making it effective against weak or common passwords.

Question 21: When an ACE-certified examiner testifies as an expert witness, Federal Rule of Evidence 702 requires that expert testimony be based on sufficient facts and that the methodology be:

Approved by a federal agency prior to trial
Peer-reviewed in at least two forensic journals
Validated by at least three independent forensic laboratories
The product of reliable principles reliably applied to the facts (Correct answer)

Correct answer: The product of reliable principles reliably applied to the facts

FRE 702 (codifying Daubert) requires expert testimony to be based on sufficient facts, reliable methodology, and reliable application of that methodology to the case facts.

Question 22: An examiner uses FTK to analyze a FAT32 volume and notices directory entries with a first byte of 0xE5. What does this signify?

An extended attribute entry for long file name support
A volume label entry at the root directory
A system file protected by Windows File Protection
A deleted directory entry that may still have recoverable data (Correct answer)

Correct answer: A deleted directory entry that may still have recoverable data

In FAT file systems, a 0xE5 value in the first byte of a directory entry indicates the file was deleted, though its cluster chain may still hold recoverable data.

Question 23: Which AccessData tool is specifically designed for enterprise-scale evidence collection across networked endpoints without physical access?

FTK Imager
FTK Enterprise / AD Enterprise (Correct answer)
PRTK (Password Recovery Toolkit)
Registry Viewer

Correct answer: FTK Enterprise / AD Enterprise

AD Enterprise (FTK Enterprise) performs remote live acquisition and triage across networked endpoints without requiring physical removal of drives.

Question 24: When acquiring a forensic image of a hard drive, the investigator calculates an MD5 hash before and after the process. The hashes match. What does this confirm?

The image is encrypted
The drive has no bad sectors
The image was compressed successfully
The acquisition was completed without altering the original data (Correct answer)

Correct answer: The acquisition was completed without altering the original data

Matching pre- and post-acquisition hashes confirm that the original evidence was not modified during the imaging process.

Question 25: What does Windows Security Event ID 4625 indicate?

An audit policy was changed
A privileged service was started
A failed logon attempt occurred (Correct answer)
A user account was created

Correct answer: A failed logon attempt occurred

Event ID 4625 is logged whenever an account fails to authenticate, which is critical for detecting brute force attacks and unauthorized access attempts.

Question 26: Which of the following is an example of improper communication during a forensic investigation?

Documenting tool output in the case log
Submitting a written report to the supervising agency
Briefing the retaining attorney on preliminary findings
Discussing case details with opposing counsel without authorization (Correct answer)

Correct answer: Discussing case details with opposing counsel without authorization

Forensic examiners must not communicate case details to opposing counsel without explicit authorization from the retaining attorney or agency.

Question 27: What is a rule-based (or hybrid) attack in PRTK?

Splitting a brute force attack across multiple processors
Using known plaintext to derive the encryption key
Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates (Correct answer)
Combining two dictionary files into a single wordlist

Correct answer: Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates

A rule-based attack applies mutations — such as capitalization, substitution, or appending digits — to dictionary entries to cover predictable password patterns.

Question 28: An examiner is analyzing Windows Volume Shadow Copies (VSS). What forensic value do they provide?

They contain encrypted copies of all user passwords
They provide point-in-time snapshots of the file system allowing recovery of previous file versions (Correct answer)
They store browser history across all user profiles
They log all network connections made by the system

Correct answer: They provide point-in-time snapshots of the file system allowing recovery of previous file versions

Volume Shadow Copies are point-in-time snapshots of the file system that can contain previous versions of files, deleted files, and earlier registry states.

Question 29: Which skill is most important for success in Foundational Concepts & Principles within ACORD Certified Expert?

Avoiding feedback
Working without any training
Continuous learning and adaptation (Correct answer)
Resisting change

Correct answer: Continuous learning and adaptation

Continuous learning ensures professionals stay current with evolving practices in Foundational Concepts & Principles.

Question 30: Which cloud acquisition scenario presents the greatest legal complexity for a forensic examiner?

Extracting cached cloud files from browser history
Acquiring data from a locally-synced cloud folder on a seized laptop
Imaging a locally-attached USB drive containing cloud backup files
Obtaining data directly from a cloud provider's servers across international jurisdictions (Correct answer)

Correct answer: Obtaining data directly from a cloud provider's servers across international jurisdictions

Cross-border cloud data requests require compliance with international laws (e.g., GDPR, MLAT treaties), making them legally complex beyond domestic warrant authority.

Question 31: Which of the following best describes the ACE Code of Ethics principle of 'non-maleficence'?

Treating all clients equally regardless of background
Providing the greatest benefit to the client
Maintaining accurate client records
Avoiding actions that cause harm to clients (Correct answer)

Correct answer: Avoiding actions that cause harm to clients

Non-maleficence means 'do no harm' and obligates trainers to avoid practices that could injure or negatively impact clients.

AccessData Certified Examiner (ACE)

The ACE certification validates a digital forensic examiner's proficiency with AccessData's forensic tools including FTK, FTK Imager, Registry Viewer, and Password Recovery Toolkit. It covers evidence acquisition, artifact analysis, network/memory forensics, and legal compliance.

Questions

90 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds