Podcast
Questions and Answers
In FTK, how are files primarily identified?
In FTK, how are files primarily identified?
- By their creation date
- By their header (correct)
- By their file extension
- By their file size
Quickpicks in FTK can be temporarily disabled using a suspend button.
Quickpicks in FTK can be temporarily disabled using a suspend button.
True (A)
Which tab in FTK allows navigation through evidence using a directory structure?
Which tab in FTK allows navigation through evidence using a directory structure?
Explore Tab
In FTK, the __________ tab organizes evidence files by category.
In FTK, the __________ tab organizes evidence files by category.
Match the following FTK tabs with their primary function:
Match the following FTK tabs with their primary function:
Where can drive free space be found within FTK's interface?
Where can drive free space be found within FTK's interface?
The 'Add New Tab' function in FTK creates a completely blank, user-defined tab with no pre-existing filters or settings.
The 'Add New Tab' function in FTK creates a completely blank, user-defined tab with no pre-existing filters or settings.
Which FTK tab is used to query the text index?
Which FTK tab is used to query the text index?
What type of expressions are used in the Index Search Tab?
What type of expressions are used in the Index Search Tab?
To view the interpretation of hex data in FTK, it must first be __________ on the Hex Tab from the File Content View.
To view the interpretation of hex data in FTK, it must first be __________ on the Hex Tab from the File Content View.
Quickpicks in FTK can be temporarily disabled using a suspend button on the toolbar.
Quickpicks in FTK can be temporarily disabled using a suspend button on the toolbar.
Which FTK tab is used to navigate through evidence via directory structure?
Which FTK tab is used to navigate through evidence via directory structure?
The ________ Tab in FTK organizes evidence files by category.
The ________ Tab in FTK organizes evidence files by category.
Match the FTK tabs with their primary function:
Match the FTK tabs with their primary function:
Which of the following viewing options in FTK allows for interpretation of hex data?
Which of the following viewing options in FTK allows for interpretation of hex data?
The 'Add New Tab' function in FTK creates a completely blank, customizable tab with no pre-existing filters or settings.
The 'Add New Tab' function in FTK creates a completely blank, customizable tab with no pre-existing filters or settings.
Which FTK tab provides access to limited system information artifacts extracted from full system partition images?
Which FTK tab provides access to limited system information artifacts extracted from full system partition images?
Within the FTK interface, which tab would an investigator primarily use to conduct complex searches using Text Index Regular Expression (TR1) queries covering indexed content?
Within the FTK interface, which tab would an investigator primarily use to conduct complex searches using Text Index Regular Expression (TR1) queries covering indexed content?
In FTK, to find unallocated clusters and slack space within a drive, one would typically navigate to the 'Free Space' section located under the ______ Category on the Overview Tab.
In FTK, to find unallocated clusters and slack space within a drive, one would typically navigate to the 'Free Space' section located under the ______ Category on the Overview Tab.
Flashcards
Explore Tab
Explore Tab
Navigating evidence via directory structure.
Quickpicks
Quickpicks
Allows user-selectable focus with icon showing selected status. Can be suspended.
Overview Tab
Overview Tab
Evidence files organized by category.
File Identification
File Identification
Signup and view all the flashcards
Hex View
Hex View
Signup and view all the flashcards
Text View
Text View
Signup and view all the flashcards
Email Tab
Email Tab
Signup and view all the flashcards
Graphic Tab
Graphic Tab
Signup and view all the flashcards
Video Tab
Video Tab
Signup and view all the flashcards
Index Search Tab
Index Search Tab
Signup and view all the flashcards
Quickpicks Function
Quickpicks Function
Signup and view all the flashcards
Filtered View
Filtered View
Signup and view all the flashcards
File Properties View
File Properties View
Signup and view all the flashcards
Hex Interpreter
Hex Interpreter
Signup and view all the flashcards
Video Thumbnails
Video Thumbnails
Signup and view all the flashcards
Live Search
Live Search
Signup and view all the flashcards
System Information Tab
System Information Tab
Signup and view all the flashcards
Add New Tab
Add New Tab
Signup and view all the flashcards
Study Notes
Module Objectives
- There are tabs within FTK
- There are Viewing Options
- Hex
- Text
- Filtered
- Natural
- There are dockable Panes
Explore Tab
- Used for navigation through the evidence via the directory structure
Quickpicks
- Allows user selectable focus
- An icon shows selected status
- Can be suspended using the Quickpicks suspend button located on the toolbar
Overview Tab
- It is used to organize evidence files by category
File Identification
- Files are identified by their header and not their extension
Viewing Options
- Hex View shows Hex text filtered in natural format
- Text View shows Lagos, Nigeria, Attention: The President CEO Dear Sir
- Filtered view shows Confidential Business Letter
- Natural View is another option
Viewing File Properties
- Used for file system and file metadata which includes: -Application CLSID: -Category Presentation Target
- File Size
- Line Count
- Paragraphs
- Slides
- Notes
- Hidden Slides
- Multimedia Clips
- Crop or Scale
- Document Sections Count
- Document Section Titles
- Manager
- Company
- Up-to-date Links
Hex Interpreter
- Interpretation of hex data requires highlighting it on the Hex Tab from the File Content View
Drive Free Space
- Free Space can be found on the Overview Tab, under File Category
Email Tab
- Used to organize email by type and viewable via content and attachment
Graphic Tab
- Allows user to view graphics -Checked graphics can be used in the reporting process
- Quickpicks can focus graphic content
- Allows user to view case graphics via the thumbnail and in full size
Video Tab
- Lists video thumbnails for quick video scrolling
- Video files processed for video thumbnails will be organized here
Internet/Chat Tab
- Contains the same content as on the Overview Tab
- Expanded Internet/Chat data and Internet containers will be available
Bookmarks Tab
- It contains:
- Bookmark Comments
- File Comments
- Supplementary Files
- Selections
- Selection Comments
- It includes:
- Names: Arabic Text Doc and Japanese text doc
Live Search Tab
- In the Live Search Tab there is a Search by text, by pattern, and by hex option
Index Search Tab
- The index search tab focuses the query of the text index
System Information Tab
- System Information Tab shows limited system information artifacts extracted from full system partition images and organized for easy viewing and analysis
Add New Tab
- Can use newly selected tabs and duplicate it
- A Tab will be named with the desired custom name
- Tab filters make custom tabs most useful
Dockable Panes
- Click the title bar within a window to adjust the layout
- Move to the desired location
- Hover over the location tab
- Drop to re-dock the window
Save/Reset/Lock Panes
- Tabs can be:
- Saved to current layout
- Restored to current saved layout
- Reset to AD default location
- Locked to prevent movement
Module Review
- Tabs Within FTK
- Viewing Options
- Hex
- Text
- Filtered
- Natural
- Dockable Panes
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Related Documents
Description
This lesson covers various tabs within FTK, including the Explore and Overview tabs. It also explains the different viewing options available, such as Hex, Text, Filtered, and Natural views. Additionally, it details how to view file properties, including file system and file metadata.
