You are converting one image file format to another using FTK Imager. Why are the hash values of the original image and the resulting new image the same?

Question

Options

• Abecause FTK Imager's progress bar tracks the conversion
• Bbecause FTK Imager verifies the amount of data converted
• Cbecause FTK Imager compares the elapsed time of a conversion
• Dbecause FTK Imager hashes only the data during the conversion

• A
  7% (2)
• B
  4% (1)
• C
  11% (3)
• D
  79% (22)

Explanation

Option D is correct because FTK Imager computes hash values against the raw underlying data (the actual disk sectors/bytes) rather than the file format's container, headers, or metadata. When you convert between formats (e.g., E01 to RAW), the container changes but the evidence data does not - so hashing only that data produces an identical result both before and after conversion, confirming forensic integrity.

Why the distractors are wrong:

• A - The progress bar is a UI element tracking completion speed, entirely unrelated to how hashes are calculated.
• B - Verifying the amount of data would detect truncation but wouldn't prove the data's content is identical; that requires hashing the data itself.
• C - Elapsed time is a performance metric with no bearing on data integrity or hash computation.

Memory tip: Think "format is the wrapper, data is the evidence." FTK Imager ignores the wrapper and hashes only the evidence - so changing the wrapper (format conversion) never changes the hash.

No community discussion yet for this question.