Which three items are displayed in FTK Imager for an individual file in the Properties window? (Choose three.)

Question

Options

• Aflags
• Bfilename
• Chash set
• Dtimestamps
• Eitem number

• A
  91% (30)
• C
  6% (2)
• E
  3% (1)

Explanation

FTK Imager's Properties window for an individual file displays flags (file system attributes such as read-only, hidden, archive, or system), the filename, and timestamps (including created, accessed, and modified times - the MAC times commonly analyzed in forensic investigations). These three items are core metadata that investigators examine directly at the file level without additional processing.

Why the distractors are wrong:

• C (hash set): Hash sets are used in FTK's hash analysis feature to flag known files (e.g., NSRL), not displayed as a property of an individual file in the Properties window.
• E (item number): Item numbers are internal sequence identifiers used in the evidence tree/case structure, not surfaced in the individual file Properties view.

Memory tip: Think F-B-T - Flags, (file)name, Timestamps - the three things you'd want to know about any suspect file at a glance: what it's called, what attributes it carries, and when it was touched.

No community discussion yet for this question.