Question 66 (practice exam 14) (additional questions)

Q: What is the purpose of FTK Imager? A: Creating forensic disk images without modifying original evidence.

Q: What distinguishes FTK Imager from the 'dd' tool? A: FTK Imager is a proprietary tool, while 'dd' is open-source.

Q: What type of data is Memdump used to collect? A: Content within a host's RAM.

Q: Is Autopsy a proprietary or open-source tool? A: Open-source.

Q: What is included in a forensic disk image created by FTK Imager? A: File slack, unallocated space, and drive free space.

Q: What is the primary advantage of using FTK Imager or 'dd' for forensic imaging? A: Preserving the original evidence in an unmodified state.

Q: Which tool is specifically designed for cross-platform forensic analysis? A: Autopsy.