When using PRTK to attack encrypted files exported from a case, which statement is true?

Question

Options

• APRTK will request the user access control list from FTK.
• BPRTK will generate temporary copies of decrypted files for printing.
• CFTK will stop all active jobs to allow PRTK to decrypt the exported files.
• DFile hash values will change when they are saved in their decrypted format.
• EAdditional interoperability between PRTK and NTAccess becomes available when files begin decrypting.

• A
  14% (4)
• B
  7% (2)
• C
  3% (1)
• D
  76% (22)

Explanation

When PRTK decrypts an encrypted file and saves the result, the underlying binary data fundamentally changes - encrypted bytes are replaced with plaintext bytes - so the hash value (MD5, SHA-1, etc.) of the decrypted file will differ from the original encrypted file. This is expected and forensically significant: investigators must document both the original hash (proving integrity of the acquired evidence) and the new hash of the decrypted version.

Why the distractors are wrong:

• A is fabricated - PRTK does not communicate with FTK to retrieve user access control lists; it works directly on exported encrypted files.
• B is invented - PRTK has no feature for generating temporary decrypted copies specifically for printing.
• C is incorrect - FTK does not halt its processing queue to accommodate PRTK decryption; the two tools operate independently.
• E is a distractor mixing real product names (NTAccess is an AccessData tool for Windows account recovery) with a false claim - no special interoperability is triggered mid-decryption.

Memory tip: Think of a hash as a "fingerprint of content." Decryption literally changes the file's content (scrambled → readable), so the fingerprint must change. A hash that stayed the same would mean the file wasn't actually altered - which would mean decryption failed. If the content changes, the hash changes - always.

No community discussion yet for this question.