What are three image file formats that can be read by FTK Imager? (Choose three.)

The correct answer is A. E01 files B. raw (dd) image files C. SafeBack version 2.2 image files. FTK Imager supports reading E01 (EnCase evidence) files, raw/dd images, and SafeBack version 2.2 images - three widely-used forensic formats that were standard when FTK Imager's compatibility list was established. SafeBack version 3.0 (D) introduced a redesigned format that FTK…

Data Acquisition and Preservation

Question

What are three image file formats that can be read by FTK Imager? (Choose three.)

Options

AE01 files
Braw (dd) image files
CSafeBack version 2.2 image files
DSafeBack version 3.0 image files
ESymantec Ghost compressed image files

How the community answered

(47 responses)

A
91% (43)
D
6% (3)
E
2% (1)

Explanation

FTK Imager supports reading E01 (EnCase evidence) files, raw/dd images, and SafeBack version 2.2 images - three widely-used forensic formats that were standard when FTK Imager's compatibility list was established. SafeBack version 3.0 (D) introduced a redesigned format that FTK Imager does not natively support, making it a common trap answer; the version number change matters. Symantec Ghost (E) is a disk cloning/backup format, not a forensic imaging format - FTK Imager cannot parse its compressed .gho structure.

Memory tip: Think "ERS" - E01, Raw, Safeback 2.x. For SafeBack, remember "2 is too old to be excluded but 3 is too new to be included."

Topics

#FTK Imager#forensic imaging formats#E01/raw/SafeBack formats#evidence acquisition

Community Discussion

No community discussion yet for this question.

Full A30-327 Practice