CHFI Computer Forensics Fundamentals and Process Practice Question
A forensic analyst needs to create a forensic image of a suspect's hard drive using FTK Imager. Which of the following image formats is MOST appropriate for maintaining evidence integrity and allowing compression?
⚠ Common exam trap
Many exam-takers choose Raw/DD (.dd) because it is the simplest and most universally accepted format, but they overlook that FTK Imager's .E01 format provides built-in compression and hash verification, which are critical for both integrity and practical storage management in forensic acquisitions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EnCase image format (.E01)
FTK Imager natively supports the EnCase image format (.E01), which is the most appropriate choice because it maintains evidence integrity through embedded CRC32 and MD5/SHA-1 hash verification while also supporting optional compression. Unlike raw/DD images, .E01 files can be segmented and compressed without losing forensic integrity, making them ideal for both storage efficiency and court-admissible evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ISO image format (.iso)
Why it's wrong here
The ISO image format is designed specifically for optical media such as CDs and DVDs, using 2048-byte sectors and lacking the partition table, disk geometry, and unallocated-space preservation needed for hard drive forensics. It cannot capture deleted files, slack space, or drive free space in a forensically complete manner, so it is unsuitable as a forensic image of a hard disk.
- ✓
EnCase image format (.E01)
Why this is correct
EnCase image format (.E01) is a forensic evidence file format that stores bit-for-bit data while supporting compression, per-block CRC32 integrity checks, and case metadata such as examiner name, date, and acquisition notes. It also incorporates MD5 or SHA-1 hash values in the file header, enabling verification that the image exactly matches the original media. Because E01 is widely recognized and accepted by courts and forensic tools, it is the standard choice for FTK Imager acquisitions.
- ✗
Advanced Forensic Format (AFF)
Why it's wrong here
Advanced Forensic Format (AFF) is an open, extensible format that does support compression, metadata, and integrity hashes, making it technically capable for forensic imaging. However, FTK Imager does not primarily use AFF—it defaults to and is optimized for E01—and AFF formats (including AFF4) are less commonly encountered in standard legal proceedings than E01, creating interoperability concerns. Thus, while AFF is a valid forensic format, it is the wrong choice for this FTK Imager workflow.
- ✗
Raw/DD image (.dd)
Why it's wrong here
A raw/DD image (.dd) is a simple bit-for-bit copy of the source drive, which can be read as a standalone block device. However, it has no native support for compression, metadata, or embedded integrity hashes; any verification must be performed using a separate external tool such as md5sum or sha256sum. Without built-in checksums, raw images are prone to silent data corruption during storage or transfer, and they consume significantly more space than compressed E01 files, so they do not meet the full forensic reporting and integrity requirements.
Go deeper
Related to this question
Learn chapter
Evidence Handling and Chain of Custody
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
Key term
EnCase Forensic
EnCase Forensic is a digital forensics software suite used by investigators to acquire, analyze, and report on data from computers and mobile devices in a legally admissible way.
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.