Which two statements are true? (Choose two.)

Question

Options

• APRTK can recover Windows logon passwords.
• BPRTK must run in conjunction with DNA workers to decrypt EFS files.
• CPRTK and FTK must be installed on the same machine to decrypt EFS files.
• DEFS files must be exported from a case and provided to PRTK for decryption.

• A
  91% (30)
• B
  6% (2)
• D
  3% (1)

Explanation

A is correct because PRTK (AccessData's Password Recovery Toolkit) is specifically designed to recover Windows logon passwords by attacking NTLM/LM hashes extracted from the SAM database - this is one of its core forensic use cases.

C is correct because EFS (Encrypting File System) decryption requires PRTK to directly access the FTK case database to retrieve the necessary certificate and key material. This tight integration requires both applications to reside on the same machine - there is no remote/cross-machine handoff supported for this workflow.

B is wrong because DNA (Distributed Network Attack) workers are used for distributed password cracking to increase speed/scale, but they are not a requirement for EFS decryption specifically. EFS decryption depends on the FTK/PRTK co-installation, not DNA infrastructure.

D is wrong because EFS files do not need to be manually exported from the case. When FTK and PRTK are on the same machine, PRTK accesses the encrypted files directly through the FTK case - no export step is required.

Memory tip: Think "Same Machine = Same Keys" - EFS encryption is tied to Windows certificates, so PRTK needs to be physically co-located with FTK to reach those keys. If you remember that EFS decryption is about proximity (same machine), options B and D - which imply external processes or manual exports - fall away naturally.

No community discussion yet for this question.