Which statement is true about Processes to Perform in FTK?

Question

Options

• AProcessing options can be chosen only when adding evidence.
• BProcessing options can be chosen during or after adding evidence.
• CProcessing options can be chosen only after evidence has been added.
• DIf processing is not performed while adding evidence, the case must be started again.

• A
  3% (1)
• B
  94% (33)
• D
  3% (1)

Explanation

Option B is correct because FTK (Forensic Toolkit) is designed with flexibility in mind - investigators can select processing options (such as hashing, indexing, or expanding compound files) either at the time of adding evidence or at a later point using post-processing/additional analysis features on already-added evidence.

Why the distractors are wrong:

• A is too restrictive in one direction - it incorrectly implies you lose the ability to process after evidence is added.
• C is too restrictive in the opposite direction - you don't have to wait; processing can begin immediately during the add-evidence workflow.
• D is false and represents the most severe misconception - FTK never requires restarting a case simply because processing was skipped initially; that would make the tool impractical for real investigations.

Memory tip: Think of FTK processing options as a "now or later" choice - like pausing a download and resuming it. You're never locked out and never forced to start over. If you see any answer that says "only" or "must restart," treat it as a red flag.

No community discussion yet for this question.