Which type of evidence can be added to FTK Imager?

Question

Options

• Aindividual files
• Ball checked items
• Ccontents of a folder
• Dall currently listed items

• A
  5% (2)
• B
  3% (1)
• C
  89% (34)
• D
  3% (1)

Explanation

Contents of a Folder (C) is a valid evidence source type available in FTK Imager's "Add Evidence Item" dialog. When you select this option, FTK Imager treats the folder as a logical evidence container, allowing you to analyze its structure and files without requiring a full disk image.

Why the distractors are wrong:

• A (Individual files) - FTK Imager does not offer a standalone "individual files" source type; you access individual files after adding a supported evidence source, not as the source itself.
• B (All checked items) - This phrasing sounds like a bulk-selection action within a UI, not an evidence source type; it does not correspond to any option in the Add Evidence Item wizard.
• D (All currently listed items) - Similarly, this describes a selection state, not a recognized evidence source type in FTK Imager.

Memory tip: Think of FTK Imager's evidence types as things that contain data at different levels - physical drives, logical drives, image files, and folders (a container you can navigate into). If an answer describes a container, it's likely correct; if it describes an action or selection state, it's a distractor.

No community discussion yet for this question.