You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)

The correct answer is A. MD5 B. SHA1 C. filename. When FTK Imager exports a file hash list, it records each file's MD5 hash (A), SHA1 hash (B), and filename (C) - these three fields form the core purpose of a hash list: to cryptographically identify and catalog files for integrity verification and known-file matching (e.g…

Data Acquisition and Preservation

Question

You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)

Options

AMD5
BSHA1
Cfilename
Drecord date
Edate modified

How the community answered

(45 responses)

A
93% (42)
D
4% (2)
E
2% (1)

Explanation

When FTK Imager exports a file hash list, it records each file's MD5 hash (A), SHA1 hash (B), and filename (C) - these three fields form the core purpose of a hash list: to cryptographically identify and catalog files for integrity verification and known-file matching (e.g., against NSRL databases).

Why the distractors are wrong: "Record date" (D) is not a field FTK Imager includes in the hash list export - it's not a standard file metadata attribute in that context. "Date modified" (E) is file metadata that appears in FTK Imager's directory listing or full case reports, but it is not part of the dedicated hash list file.

Memory tip: Think of a hash list's job as answering "What is this file called, and can I prove it's unchanged?" - Name (filename) + proof (MD5 + SHA1). Timestamps belong to timelines, not hash lists.

Topics

#File hashing#FTK Imager#Hash verification#MD5/SHA1

Community Discussion

No community discussion yet for this question.

Full A30-327 Practice