Why are the hash values of the original image and the resulting new image the same? Because FTK imager hashed only the data during the conversion Which statement is true about Evidence Processing in FTK? Processing options can be chosen during or after adding evidence What type of evidence can be added to FTK imager? contents of a folder Which of the following is NOT a section in an FTK report? Thumbnails When using PRTK to attack encrypted files exported from a case, which statement is true? File hash values will change when they are saved in their decrypted format In FTK, which search broadening option allows you to find grammatical variations of the word 'kill' such as 'killer', 'killed', or 'killing'? Stemming What is the purpose of marking a file as Privileged in FTK? It prevents Case Reviewers from viewing the file What is the purpose of the Golden Dictionary? maintains previously recovered passwords Which statement is true about using FTK imager to export a folder and its subfolders? Exporting a folder will copy all its subfolders When using Registry Viewer to view a key with 20 values, what option can be used to display only 5 of the 20 values in a report? Summary Report In which file format can a list of hash values be imported into FTK? CSV Which of the following is NOT an option available in the FTK report? include PRTK output list Which statement is true concerning the Evidence Discovery Option windows? A recognized file type can be reassigned by this function After processing a case in FTK using all of the default options, a list of 400 names is supplied in electronic format. Which file must be used to recover the EFS password for use in FTK? SECURITY You are converting one image file format to another using FTK imager.

All other necessary components for EFS decryption are present in the case. However, no decrypted subitems are present. After creating a case in FTK, the Encrypted Files container/node lists EFS files.

Windows 10 reclaim disk space 449