In FTK Imager, which mechanism is used to verify the integrity of the acquired data?

• A. SHA-1 hash
• B. CRC check
• C. MD5 hash
• D. Digital signature

Answer: (C)

Ensuring integrity comes from producing a fingerprint of the exact data at the moment of capture and then re-checking that fingerprint later. In FTK Imager, that fingerprint is an MD5 hash. MD5 yields a fixed 128-bit digest that uniquely represents the acquired data; if you recompute the hash after storage and it matches the original MD5 value, you know the data haven’t changed. This approach is preferred here over other options because CRC is only a simple error-detection method, not cryptographically secure for confirming data integrity, and digital signatures relate to authenticity rather than a straightforward integrity check. While SHA-1 is also a hash function, the tool’s common workflow for this purpose uses MD5 to verify the image’s integrity.