In FTK, when you view the Total File Items container (rather than the Actual Files container), why are there more items than files?
When using Registry Viewer to view a key with 20 values, what option can be used to display only 5 of the 20 values in a report?
Which pattern does the following regular expression recover?
(\d{4}[\- ]){3}\d{4}
You have processed a case in FTK using all the default options. The investigator supplies you with a list of 400 names in an electronic format. What is the quickest way to search
unallocated space for all of these names?