In FTK, when you view the Total File Items container (rather than the Actual Files container), why are there more items than files?

Question

Options

• ATotal File items includes files that are in archive files, while Actual Files does not.
• BTotal File items includes all unfiltered files while Actual Files includes only checked files.
• CTotal File items includes all KFF Ignorables while Actual Files includes only the KFF Alerts.
• DTotal File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files only includes files in the Graphics tab while excluding attachments in the E-mail tab.

• A
  92% (46)
• B
  2% (1)
• C
  2% (1)
• D
  4% (2)

Explanation

Option A is correct because FTK automatically processes and "expands" archive files (ZIP, RAR, PST, etc.) during case processing - the files inside an archive are indexed and accessible as individual items. Total File Items counts both the archive container itself and every file extracted from within it, so a single ZIP file containing 50 documents adds 51 items to the total. Actual Files counts only the discrete files as they physically exist on the evidence, without expanding archives.

Why the distractors are wrong:

• B confuses the Total/Actual distinction with the checked/unchecked filter mechanism, which is a separate feature used for bookmarking and reporting.
• C misapplies KFF (Known File Filter) logic - KFF categorizes files by hash (Alert, Ignorable, Unknown) but doesn't explain the count gap between these two containers.
• D is fabricated; both containers reflect all file types across all tabs (Graphics, E-Mail, etc.) - no tab-based exclusion rule drives the difference.

Memory tip: Picture a ZIP file as a shipping box. Actual Files counts the box. Total File Items counts the box plus every item inside it - FTK "opens" every archive it finds.

No community discussion yet for this question.