Which three items are contained in an Image Summary File using FTK Imager? (Choose three.)

Question

Options

• AMD5
• BCRC
• CSHA1
• DSector Count
• ECluster Count

• A
  92% (34)
• B
  3% (1)
• E
  5% (2)

Explanation

An FTK Imager Image Summary File records both cryptographic hash values and physical media metrics to verify acquisition integrity. MD5 (A) and SHA1 (C) are the two hashing algorithms FTK Imager computes and stores to confirm the image is an exact, unaltered copy of the source media. Sector Count (D) is also recorded because it documents the physical size of the acquired drive at the sector level, allowing examiners to confirm completeness of the acquisition.

Why the distractors are wrong:

• CRC (B): CRC is a simpler error-detection checksum used in storage protocols and file formats (like E01 segment verification), but it is not one of the three summary fields FTK Imager reports in its Image Summary File.
• Cluster Count (E): Clusters are a filesystem-level concept (NTFS, FAT, etc.), not a physical media property. FTK Imager operates at the sector/bit-stream level and does not report cluster counts in the summary.

Memory tip: Think "Two Hashes + One Size" - FTK's summary file proves authenticity (MD5 + SHA1) and completeness (Sector Count). If a choice refers to filesystem structures (clusters) or a weaker checksum (CRC), it belongs to a different layer of forensics, not the image summary.

No community discussion yet for this question.