Which statement is true about using FTK Imager to simultaneously create multiple images of a single source?

1. A. In the Image Creation Wizard, you should select the Add Additional Drives option.
2. B. You should use the Create Multiple Images option to create server image objects.
3. C. You should note the evidence item source signature and add it to the Image View pane.
4. D. In the Image Creation Wizard, you should add multiple destination jobs from the same source prior To beginning image creation.

Correct Answer: D

When adding data to FTK, which statement about DriveFreeSpace is true?
Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

FTK uses Data Carving to find which three file types? (Choose three.)

1. A. JPEG files
2. B. Yahoo! Chat Archives
3. C. WPD (Word Perfect Documents)
4. D. Enhanced Windows Meta Files (EMF)
5. E. OLE Archive Files (Office Documents)

Correct Answer: A
What happens when a duplicate hash value is imported into a KFF database?
A. It will not be accepted.
B. It will be marked as a duplicate.
C. The database will be corrupted.
D. The database will hide the duplicate.

When previewing a physical drive on a local machine with FTK Imager, which statement is true?

1. A. FTK Imager can block calls to interrupt 13h and prevent writes to suspect media.
2. B. FTK Imager can operate from a USB drive, thus preventing writes to suspect media.
3. C. FTK Imager can operate via a DOS boot disk, thus preventing writes to suspect media.
4. D. FTK Imager should always be used in conjunction with a hardware write protect device toprevent writes to suspect media.

Correct Answer: D

Into which two categories can an imported hash set be assigned? (Choose two.)

1. A. alert
2. B. ignore
3. C. contraband
4. D. system files

Correct Answer: AB