When can the Expand Compound Files processing option be executed in FTK?

The Expand Compound Files processing option in FTK can be executed during both the pre-processing phase and after the case creation phase. This feature is crucial when handling compound files, which may contain multiple layers of data, like OLE (Object Linking and Embedding) containers or Microsoft Office documents.

During pre-processing, this option allows examiners to extract and analyze the contents of compound files early in the investigation, ensuring that all relevant information is available for examination right from the start. This early extraction can be advantageous for identifying key evidence without waiting for more detailed analysis to begin.

Additionally, executing this function after case creation serves as a follow-up procedure, enabling investigators to delve deeper into the contents of compound files as needed throughout the investigative process. This flexibility is essential, particularly when new or unexpected compound files are encountered after the initial analysis begins.

By allowing the Expand Compound Files option in these two stages, FTK maximizes the potential for thorough and efficient examination of all data types, ensuring that important evidence contained within those compound files is not overlooked.