Group Outline
1. To obtain protected files on a live machine with FTK Imager, which evidence item should be added? b) currently booted drive
2. You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?
d) because FTK Imager hashes only the data during the conversion
3. You successfully export and create a file hash list while using FTK Imager. Which piece of information is NOT included in this file?
c) date modified
4. Which item in the Properties window is NOT displayed in FTK Imager for an individual file? a) Item number
5. What type of evidence can be added to FTK Imager? a) contents of a folder
6. While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and time. Which FTK Imager feature allows you display the information as a date and time? b) Hex Value Interpreter
7. Which two image formats contain an embedded hash value for file verification? d) S01 e) E01
8. Which statement is true about using FTK Imager to simultaneously create multiple images of a single source?
a) In the Image Creation Wizard, add multiple destination jobs from the same source prior to beginning image creation
9. Which image file format CAN NOT be read by FTK Imager? c) Norton Ghost compressed image files
10. You create two evidence images from the suspect's drive: suspect.E01 and suspect.001.
You want to be able to verify that the image hash values are the same for suspect.E01 and suspect.001 image files. Which file has the hash value for the Raw (dd) image0? A. suspect.001.txt
11. Which statement is true about using FTK Imager to export a folder and its subfolders? d) Exporting a folder will copy all its subfolders
12. When using FTK Imager to preview a hard drive attached to a local machine, which statement is true?
b) FTK Imager should
2. You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?
d) because FTK Imager hashes only the data during the conversion
3. You successfully export and create a file hash list while using FTK Imager. Which piece of information is NOT included in this file?
c) date modified
4. Which item in the Properties window is NOT displayed in FTK Imager for an individual file? a) Item number
5. What type of evidence can be added to FTK Imager? a) contents of a folder
6. While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and time. Which FTK Imager feature allows you display the information as a date and time? b) Hex Value Interpreter
7. Which two image formats contain an embedded hash value for file verification? d) S01 e) E01
8. Which statement is true about using FTK Imager to simultaneously create multiple images of a single source?
a) In the Image Creation Wizard, add multiple destination jobs from the same source prior to beginning image creation
9. Which image file format CAN NOT be read by FTK Imager? c) Norton Ghost compressed image files
10. You create two evidence images from the suspect's drive: suspect.E01 and suspect.001.
You want to be able to verify that the image hash values are the same for suspect.E01 and suspect.001 image files. Which file has the hash value for the Raw (dd) image0? A. suspect.001.txt
11. Which statement is true about using FTK Imager to export a folder and its subfolders? d) Exporting a folder will copy all its subfolders
12. When using FTK Imager to preview a hard drive attached to a local machine, which statement is true?
b) FTK Imager should