Question 4 (1 point) Drive duplication is the process of creating an exact forensic image of the victim or the suspect hard drive in order to conduct the analysis on the imaged hard drive instead of the original one. The destination is a container file or image file. True False Question 5 (1 point) The E01 image file format results in a larger image file size than the raw (dd) format. True False Question 6 (1 point) Open FTK Imager in your virtual lab computer and import the raw (dd) image you created in the previous Chapter 4 lab exercises. Which of the following is the specific file system version for the NTFS partition? 8C5D-AE41 Windows XP (NTFS 3.1) Windows XP (FAT32) Page Windows 7 (NTFS 3.1)