CHFI FTK Imager Practice Question
Which of the following tools is specifically designed for forensic imaging and can create compressed, segmented, or E01 format images?
⚠ Common exam trap
Candidates often confuse dd's ability to create raw images with forensic imaging capabilities, overlooking that dd lacks native support for compression, segmentation, and E01 format, which are hallmarks of dedicated forensic tools like FTK Imager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FTK Imager
FTK Imager is specifically designed for forensic imaging and supports creating compressed, segmented, and E01 (Expert Witness Format) images. Unlike generic tools, it provides a GUI and built-in validation (e.g., MD5/SHA1 hashing) tailored for forensic acquisition, making it the correct choice for this question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
dd
Why it's wrong here
dd is a Unix command-line utility that performs raw, bit-by-bit copying to create a 'raw' or 'DD' disk image. It does not natively support forensic container formats like E01 (Expert Witness Format), nor does it provide built-in compression or segmentation of output files. Any integrity verification must be performed manually with separate hash tools, making it inadequate as a dedicated forensic imaging solution without extensive additional scripting.
- ✗
Nmap
Why it's wrong here
Nmap, short for Network Mapper, is designed for network discovery and security auditing, such as host discovery, port scanning, and service version detection. It operates at the network level and has no capability to acquire a disk image, parse file systems, or preserve digital evidence in a forensically sound manner. Using it for forensic imaging would be completely outside its intended function.
- ✓
FTK Imager
Why this is correct
FTK Imager is a GUI-based forensic imaging tool from AccessData (now Exterro) specifically built for lawful evidence acquisition. It natively supports acquisition in multiple formats, including raw (DD), E01 (Expert Witness), and the AFF format, and allows compression and segmentation of images for practical storage and transfer. The tool also generates MD5 and SHA1 hashes for integrity verification, supports read-only mounting of images for analysis, and is widely accepted in courts as a forensically sound imaging platform.
- ✗
Wireshark
Why it's wrong here
Wireshark is a network protocol analyzer used to capture and interactively inspect network traffic at the packet level. Its function is limited to decoding and troubleshooting network communications; it has no ability to create a bit-for-bit forensic image of storage media, apply write-blocking, or compute evidence-integrity hashes. Consequently, it cannot be used for disk acquisition or forensic preservation.
Go deeper
Related to this question
Learn chapter
Forensic Tools and Laboratory Setup
Key term
Disk Imaging
Disk imaging is the process of creating an exact, bit-for-bit copy of a storage drive, preserving all data, deleted files, and unallocated space for forensic analysis or system recovery.
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.