You are using FTK to process e-mail files. In which two areas can E-mail attachments be located? (Choose two.)

Question

Options

• Athe E-mail tab
• Bthe Front E-mail container in the Overview tab
• Cthe Evidence Items container in the Overview tab
• Dthe E-mail Messages container in the Overview tab

• A
  94% (15)
• D
  6% (1)

Explanation

In FTK, email attachments are accessible from the E-mail tab (A), which provides a dedicated view of email items where attachments are displayed alongside their parent messages, and from the Front E-mail container in the Overview tab (B), which categorizes and surfaces email-related objects - including attachments - extracted from the evidence.

Option C (Evidence Items container) is a general evidence tree showing all ingested items at the top level, not a filtered view of email content. Option D (E-mail Messages container) lists the raw email message files themselves, not the attachments embedded within them - attachments are treated as separate objects by FTK.

Memory tip: Think "A and B" as "Attachments" and "Big picture email view" - the E-mail tab is your attachment-focused workspace, and the Front E-mail container is your bird's-eye overview of extracted email objects. Both are email-specific areas; the distractors (C and D) are either too broad or too narrowly scoped to messages only.

No community discussion yet for this question.