Which type of evidence can be added to FTK Imager?

When using FTK Imager, the program supports the addition of various types of evidence for acquisition and analysis. Among the choices given, the contents of a folder represent a specific type of evidence that can easily be included in a forensic image created using FTK Imager. This capability allows investigators to gather and preserve data that is actively stored in a directory, which can later be analyzed during the forensic examination process.

FTK Imager is designed to capture data in a way that maintains the integrity and original structure of the files, making it reliable for legal proceedings. While the other types of evidence listed—unallocated space, deleted files, and system memory—are also relevant to forensic investigations, they require different handling and formats for imaging and may not be added as straightforwardly as folder contents within the tool's interface. Unallocated space and deleted files, for instance, refer to areas of hard drives that do not have active references and may require specialized techniques for proper acquisition, and system memory (RAM) involves volatile data that is typically preserved through a different capture method.