Mark, a forensic investigator, is tasked with investigating a disk image acquired from a suspect...

Option B. PyTSK is the best answer because the question specifically asks for a Python-based tool that integrates with The Sleuth Kit (TSK) to examine a disk image and access its files and directories. CHFI v11 explicitly includes Windows and Linux Forensics using Python , Python Digital Forensics Basics , and File System Analysis Using Autopsy and The Sleuth Kit (TSK) .

PyTSK is the Python binding or interface commonly used to work with Sleuth Kit functionality programmatically. That makes it the most natural answer when the task involves Python-based analysis of image contents. FTK Imager and Autopsy are important forensic tools, but they are not the specific Python-based interface described. py.apipkg does not fit the forensic image-analysis role being tested here.

Because the question combines Python with Sleuth Kit-based disk image access , the answer most consistent with CHFI’s Python and file-system-analysis objectives is PyTSK . It allows investigators to script file and directory examination in a structured, repeatable forensic workflow.