Create an account
FTK Imager is a write blocking device/software
False. (It will not directly write to a suspect device but windows may)
Why would FTK imager indicate drive numbers, 1,2,3, and 5?
5 and above indicates an extended partition. 1-4 indicates Primary partitions.
When exporting a file from Imager, the time and date stamps of the exported file will not match those of the file in the original image.
False. Imager will use the original times and dates for the file it exports.
When you export a file hashlist from Imager, the files go out into a plain text file.
False. They go into a CSV (comma separated values) file.
What function would you use in FTK Imager to automatically grab commonly used files from the registry?
Obtain Protected Files
How would you view all the graphics in a case in FTK
Select the root of the evdence tree and enable the quick picks for it.
Please allow access to your computer’s microphone to use Voice Recording.
Having trouble? Click here for help.
We can’t access your microphone!
Click the icon above to update your browser permissions and try again
Reload the page to try again!Reload
Press Cmd-0 to reset your zoom
Press Ctrl-0 to reset your zoom
It looks like your browser might be zoomed in or out. Your browser needs to be zoomed to a normal size to record audio.
Please upgrade Flash or install Chrome
to use Voice Recording.
For more help, see our troubleshooting page.
Your microphone is muted
For help fixing this issue, see this FAQ.
Star this term
You can study starred terms together