During the execution of a search warrant, you image a suspect drive using FTK Imager and store the Raw (dd) image files on a portable drive. Later, these files are transferred to a server for…

Question

Options

• Aopen and view the Summary file
• Bload the image into FTK and it automatically performs file verification
• Cin FTK Imager, use the Verify Drive/Image function to automatically compare a calculatedhash with a stored hash
• Duse FTK imager to create a verification hash and manually compare that value to the valuestored in the Summary file

• A
  7% (4)
• B
  3% (2)
• C
  12% (7)
• D
  78% (47)

Explanation

Option D is correct because Raw (dd) images do not embed hash values internally - the hash generated during imaging is saved separately in a plain-text Summary file. To verify integrity after the server transfer, you must use FTK Imager to recalculate a hash of the current image, then manually compare that value against the original hash recorded in the Summary file; a match confirms the data is unaltered.

Why the distractors fail:

• A is wrong because simply opening the Summary file only shows you the original hash - it does nothing to verify the current state of the image on the server.
• B is wrong because loading an image into FTK (the full forensic suite) does not automatically trigger hash verification; that is not a built-in on-load behavior.
• C is the trickiest distractor - the "Verify Drive/Image" automatic comparison works for E01/EnCase format images, which embed the hash internally. Raw/dd images store hashes externally, so a fully automatic comparison is not possible; the manual step is required.

Memory tip: Think of it this way - dd = dumb container (no embedded hash), so you must do the comparison yourself using the Summary file. E01 is the "smart" format that carries the hash inside, enabling automatic verification.

No community discussion yet for this question.