You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?
A. because FTK Imager's progress bar tracks the conversion
B. because FTK Imager verifies the amount of data converted
C. because FTK Imager compares the elapsed time of conversion
D. because FTK Imager hashes only the data during the conversion
You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)
A. MD5
B. SHA1
C. filename
D. record date
E. date modified
While analyzing unallocated space, you locate what appears to be a 64-bit Windows date and time. Which FTK Imager feature allows you display the information as a date and time?
A. INFO2 Filter
B. Base Converter
C. Metadata Parser
D. Hex Value Interpreter
In FTK, you navigate to the Graphics tab at the Case level and you do not see any graphics. What should you do to see all graphics in the case?
A. list all descendants
B. run the graphic files filter
C. check all items in the current list
D. select the Graphics container button
Click the Exhibit button.
You need to search for specific data that are located in a Microsoft Word document. You do not know the exact spelling of this datA. Using the Index Search Options as displayed in the exhibit, which changes do you make in the Broadening Options and Search Limiting Options containers?
A. check the Fuzzy box;check the File Name Pattern box; type *.doc in the pattern container
B. check the Stemming box; check the File Name Pattern box; type *.doc in the pattern container
C. check the Synonym box;check the File Name Pattern box; type *.doc in the pattern container
D. check the Stemming box; check the File Name Pattern box;type %.doc in the pattern container
You are asked to process a case using FTK and to produce a report that only includes selected graphics. What allows you to display only flagged graphics?
A. List by File Path
B. List File Properties
C. Graphic Thumbnails
D. Supplementary Files
Which data in the Registry can the Registry Viewer translate for the user? (Choose three.)
A. calculate MD5 hashes of individual keys
B. translate the MRUs in chronological order
C. present data stored in null terminated keys
D. present the date and time of each typed URL
E. View Protected Storage System Provider (PSSP) data
Which Registry Viewer function would allow you to automatically document multiple unknown user names?
A. Add to Report
B. Export User List
C. Add to Report with Children
D. Summary Report with Wildcard
Click the Exhibit button.
When decrypting EFS files in a case, you receive the result shown in the exhibit.
What is the most plausible explanation for this result?
A. The encrypted file was corrupt.
B. A different user encrypted the remaining encrypted file.
C. The hash value of the remaining encrypted file did not match.
D. The remaining encrypted file had previously been bookmarked.
E. An incorrect CRC value for the $EFS certificate was applied by the user.
Which file should be selected to open an existing case in FTK?
A. ftk.exe
B. case.ini
C. case.dat
D. isobuster.dll
