You have processed a case in FTK using all the default options. The investigator supplies you with a list of 400 names in an electronic format. What is the quickest way to search unallocated space…

Question

Options

• Abuild a dtSearch string with all 400 names
• Bcreate a Regular Expression with all the names
• Cmake an imported text file of the names in Live Search
• Duse an imported text file containing the names in Indexed Search

• A
  3% (1)
• B
  11% (4)
• C
  6% (2)
• D
  81% (29)

Explanation

Option D is correct because FTK builds a full-text index during case processing (done with default options here), and Indexed Search queries that pre-built index rather than scanning raw data - making it dramatically faster. Importing a text file lets you load all 400 names at once without manual entry, combining speed with convenience.

Why the distractors fail:

• A (dtSearch string): dtSearch syntax is powerful but manually constructing a query string with 400 names is slow, error-prone, and not the "quickest" method compared to a file import.
• B (Regular Expression): Regex runs via Live Search, which scans raw data directly rather than an index - far slower for large term lists, and crafting a 400-name regex is impractical.
• C (imported text file in Live Search): This is the closest wrong answer. Live Search also supports imported word lists, but it searches the actual evidence data in real time instead of the pre-built index, making it significantly slower.

Memory tip: Think "Indexed = Instant" - because the index was already built during processing, Indexed Search gets results fast. Live Search = "Live in the raw data = Long wait." When you have a large word list and a pre-processed case, always import into Indexed Search.

No community discussion yet for this question.