Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

Question

Options

• Alist SAM file account names in FTK
• Bview all registry files from within FTK
• Ccreate subitems of individual keys for FTK
• Dexport a registry report to the FTK case report

• A
  8% (5)
• B
  87% (55)
• C
  5% (3)

Explanation

FTK's integrated Registry Viewer is a read-only forensic tool with two core capabilities relevant here: it allows examiners to view all registry hive files directly within the FTK interface (B), and it supports exporting registry findings into the case report (D), which is essential for documentation and court presentation.

Option A is incorrect because while FTK can open the SAM hive, "listing SAM account names" is not a distinct Registry Viewer operation - it's a byproduct of viewing the hive, not a named feature of the tool. Option C is wrong because Registry Viewer is strictly read-only; creating or modifying registry keys would violate forensic integrity principles and is not a supported function.

Memory tip: Think "View and Export" - the two things a forensic examiner needs to do their job without touching the evidence. Any option that implies writing or modifying data (like "create subitems") is automatically wrong in a forensic context.

No community discussion yet for this question.