What is a true statement when previewing a physical drive with FTK Imager on a local machine?

Using FTK Imager in conjunction with a hardware write protect device is a best practice for preserving the integrity of evidence during the previewing of a physical drive. This approach ensures that no changes can be made to the drive while it is being inspected, which is essential in forensic investigations. The write protect device physically prevents any write operations to the target drive, thereby maintaining the original state of the data, which is a fundamental principle in digital forensics.

This practice is vital because altering data can compromise the integrity of the evidence, rendering it inadmissible in court or leading to incorrect conclusions during investigation. While FTK Imager has features that help in the previewing process, it does not inherently provide write protection. Therefore, combining FTK Imager with a hardware write protect device enhances the protection of the original data.