CHFI Computer Forensics Fundamentals and Process Practice Question
A forensic analyst is preparing to acquire an image from a suspect's hard drive. The analyst connects the drive to a write blocker, then uses FTK Imager to create a forensic image. Which hashing algorithm is commonly used by FTK Imager to verify image integrity?
⚠ Common exam trap
Many exam-takers confuse encryption algorithms (AES, RSA, Blowfish) with hashing algorithms, because both are used in cryptography, but only hashing algorithms like MD5 or SHA-1 are employed for integrity verification in forensic imaging tools like FTK Imager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MD5
FTK Imager uses MD5 (Message Digest 5) as its default hashing algorithm to verify the integrity of forensic images. MD5 produces a 128-bit hash value that uniquely represents the data, allowing the analyst to confirm that the acquired image is an exact bit-for-bit copy of the original drive. While SHA-1 is also supported, MD5 is the algorithm most commonly associated with FTK Imager's verification process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AES
Why it's wrong here
AES is a symmetric encryption algorithm, not used for integrity hashing.
- ✗
RSA
Why it's wrong here
RSA is an asymmetric encryption algorithm, not a hash function.
- ✗
Blowfish
Why it's wrong here
Blowfish is a symmetric cipher, not a hash.
- ✓
MD5
Why this is correct
MD5 is a hash function commonly used by FTK Imager to verify that the image is identical to the source.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
Key term
EnCase Forensic
EnCase Forensic is a digital forensics software suite used by investigators to acquire, analyze, and report on data from computers and mobile devices in a legally admissible way.
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.