FTK uses Data Carving to find which three file types? (Choose three.)

Question

Options

• AJPEG files
• BYahoo! Chat Archives
• CWPD (Word Perfect Documents)
• DEnhanced Windows Meta Files (EMF)
• EOLE Archive Files (Office Documents)

• A
  89% (31)
• B
  3% (1)
• C
  9% (3)

Explanation

FTK's Data Carving feature recovers files by scanning raw disk data for known file headers and footers, and it specifically targets JPEG files (A), Enhanced Windows Meta Files/EMF (D), and OLE Archive Files (E) - all of which have well-defined binary signatures that make them reliable carving targets. OLE is particularly valuable because it underlies legacy Office documents (.doc, .xls, .ppt), making it a high-priority format in digital forensics. Yahoo! Chat Archives (B) are recovered through FTK's artifact parsing features, not data carving, since they rely on application-specific database structures rather than simple file signatures. WPD/WordPerfect Documents (C) are not among FTK's supported carving types - WordPerfect files are uncommon in modern investigations and FTK does not include them in its carving signature library.

Memory tip: Think "JEO" - JPEG, EMF, OLE. These are all binary, signature-rich formats that carving tools love; the distractors (Yahoo Chat, WPD) are either app-dependent artifacts or niche formats outside FTK's carving scope.

No community discussion yet for this question.