CHFI Computer Forensics Fundamentals and Process Practice Question
A forensic analyst is preparing to acquire an image from a suspect's hard drive. The analyst connects the drive to a write blocker, then uses FTK Imager to create a forensic image. Which hashing algorithm is commonly used by FTK Imager to verify image integrity?
⚠ Common exam trap
Many exam-takers confuse encryption algorithms (AES, RSA, Blowfish) with hashing algorithms, because both are used in cryptography, but only hashing algorithms like MD5 or SHA-1 are employed for integrity verification in forensic imaging tools like FTK Imager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MD5
FTK Imager uses MD5 (Message Digest 5) as its default hashing algorithm to verify the integrity of forensic images. MD5 produces a 128-bit hash value that uniquely represents the data, allowing the analyst to confirm that the acquired image is an exact bit-for-bit copy of the original drive. While SHA-1 is also supported, MD5 is the algorithm most commonly associated with FTK Imager's verification process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AES
Why it's wrong here
AES is a symmetric block cipher for encrypting data, producing ciphertext rather than a fixed-length integrity digest, so it cannot verify that an acquired image matches the source. It would be the right choice when encrypting a forensic image or evidence container to protect confidentiality.
- ✗
RSA
Why it's wrong here
RSA is an asymmetric algorithm used for encryption and digital signatures, not for generating the integrity digest FTK Imager records. It would be correct when signing or encrypting data with a public/private key pair, not when verifying that an image hash matches the original drive.
- ✗
Blowfish
Why it's wrong here
Blowfish is a symmetric block cipher that encrypts data, so it produces ciphertext rather than the hash value used to confirm image integrity. It would be appropriate for encrypting evidence at rest, not for the MD5 or SHA-1 digest FTK Imager computes during acquisition.
- ✓
MD5
Why this is correct
MD5 is the default integrity hash FTK Imager applies to forensic images, generating a 128-bit digest recorded alongside the image for later verification. It satisfies the stem's requirement for confirming image integrity during acquisition, detecting any alteration between the source drive and the captured copy.
Go deeper
Related to this question
Learn chapter
Database Forensics: Investigating Data Breaches
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
Key term
EnCase Forensic
EnCase Forensic is a digital forensics software suite used by investigators to acquire, analyze, and report on data from computers and mobile devices in a legally admissible way.
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.