## 8 Compatibility with Forensic Tools  
We evaluated the watermarked disk with two mainstream suites: Autopsy 4.22 [86] and FTK Imager 4.7.1.2 [87]. All the evidence below shows that the watermark is limited to JPEG payload bytes; file system metadata and disk layout remain untouched.  
Autopsy file metadata view (Figure 6)  
Autopsy loads both disk images and lists the watermarked JPEG under the same path as the original. The File Metadata pane shows matching Modified, Accessed, and Created times and the same starting sector (7752, length 388), so the NTFS directory entry is unchanged. Thumbnail generation (521 JPEGs) and keyword search remain fully functional. The timeline module plots the same event distribution (2014-2025) for unimpeded temporal analysis.  
Figure 6: Autopsy metadata view. Identical timestamps and sector addresses confirm no modification to the NTFS entry.  
Thumbnail and timeline functions (Figures 7 and 8)  
Autopsy 4.22 generates thumbnails for 521 JPEG files and renders them in a responsive grid. Search, sort, and keyword filter tools operate normally. The timeline module plots file system events from 2014 to 2025 and reports the same event counts and date ranges as the original image. These results confirm that Autopsy's advanced analysis features remain fully operational.  
FTK Imager fidelity (Figure 9)  
FTK Imager 4.7.1.2 loads both disk images and lists them under identical folder paths in the Evidence Tree: _workingimage.dd_ and _watermarked_workingimage.dd_. In the File List, the highlighted JPEG shows the same size and timestamps in both images. The preview pane renders the watermarked picture without artefacts. PSNR = 47.8 dB and SSIM = 0.996 from the measurement confirm full visual fidelity. The matching file attributes and the  
Figure 8: Timeline. Event counts and date span match the original image.  
Figure 7: Autopsy thumbnail view. A total of 521 JPEGs rendered successfully; keyword filters are functional.  
ar artefact-free preview together verify that watermarking preserves image quality and leaves the disk image directory structure untouched.  
Hash verification (Figure 10)  
Figure 10 provides a two-level integrity check. The upper panes list the file-level SHA-256 values. The original and watermarked JPEGs show different digests, which shows that the watermark changes the file payload. The lower panes show FTK Imager's 'Drive / Image Verify' results for full-disk images. Both dialogues report the same sector count (3 565 568), identical MD5 and SHA-1 values for the image, and no bad blocks. These identical low-level metrics prove that the watermark resides inside existing sectors; it neither moves nor allocates sectors, and it leaves the partition table and file system metadata untouched. The evidence image therefore maintains full structural integrity while carrying a traceable file-scoped watermark.  
Figure 10: Hash verification. Different file hashes and identical disk-level hashes confirm watermarking within existing sectors.  
Figure 9: FTK preview. Watermarked JPEG renders cleanly with high PSNR and SSIM.  
In conclusion, the tests confirm that traceable recipient-specific watermarks can be embedded without disrupting standard forensic procedures. Disk images remain structurally and visually intact under FTK and Autopsy, and no workflow modifications are required. The watermark persists across metadata, previews, thumbnails, timelines, and hash verification and enables precise leak attribution without compromising evidentiary processes.