During the execution of a search warrant, you image a suspect drive using FTK Imager and store the Raw(dd) image files on a portable drive. Later, these files are transferred to a server for storage. How do you verify that the information stored on the server is unaltered?

1. A. open and view the Summary file
2. B. load the image into FTK and it automatically performs file verification
3. C. in FTK Imager, use the Verify Drive/Image function to automatically compare a calculatedhash with a stored hash
4. D. use FTK Imager to create a verification hash and manually compare that value to the valuestored in the Summary file

Correct Answer: D

When using FTK Imager to preview a physical drive, which number is assigned to the first logical volume of an extended partition?

1. A. 2
2. B. 3
3. C. 4
4. D. 5

Correct Answer: D

In PRTK, which type of attack uses word lists?

1. A. dictionary attack
2. B. key space attack
3. C. brute-force attack
4. D. rainbow table attack

Correct Answer: A

Which statement is true about Processes to Perform in FTK?

1. A. Processing options can be chosen only when adding evidence.
2. B. Processing options can be chosen during or after adding evidence.
3. C. Processing options can be chosen only after evidence has been added.
4. D. If processing is not performed while adding evidence, the case must be started again.

Correct Answer: B

How can you use FTK Imager to obtain registry files from a live system?

1. A. You use the Export Files option.
2. B. You use the Advanced Recovery option.
3. C. Registry files cannot be exported from a live system.
4. D. You use the Protected Storage System Provider option.

Correct Answer: A