AccessData Certified Examiner (ACE)

AccessData Certified Examiner (ACE)

The AccessData Certified Examiner (ACE) credential demonstrates the user’s proficiency with AccessData’s Forensic Toolkit (FTK). The exam is designed to test the proficiency of the user with the tool, and not necessarily forensic investigation workflows. Although there are no prerequisites for this certification, it is recommended that the user have some experience with the tool, or have taken the following course(s):

• Minimum: FTK Bootcamp
• Recommended: Forensic Toolkit 101

Course Outline

The AccessData Certified Examiner (ACE) exam covers the following topics - 

Case Processing:

1. Understand Index Search options and how to change them.

2. Understand Expansion options. (Email, Documents, Images, Internet artifacts)

3. Understand how Data Carving is configured

4. What features can only be processed from within the case, outside of the Additional Analysis wizard.

Interface:

1. Understand what data is held in the properties tab, and what is in the file list pane

2. Creating custom columns may help in the display of some data

3. Understand check marking and the impact that check marks can have.

4. Be able to configure the display time zone

Filtering:

1. Single Rule Filter

2. Multi Rule Filters

3. Nested Filters

Searching:

1. Index Searching

2. Field Searching

3. Operator Searching

Known File Filter:

1. Understand how to create a KFF profile

2. Know how to run a KFF profile (required processing options, etc)

3. Know where to look for the results and how to filter those results 

Knowledge required for the exam

As there are no prerequisite for this certification but, it is recommended that the user have some experience with the tools, or have taken the following courses:

Before August 2020:

• FTK Bootcamp
• FTK Intermediate

After August 2020:

• FTK Imager 100
• Registry Viewer 100
• Password Recovery Toolkit 100
• Forensic Toolkit 101

The ACE certification will test the user’s knowledge of forensic theory, tool features, and include hands on portion testing the user ability to use the above mentioned tools to find and report on evidence found in a case.