200-201 · Question #36
An investigator is examining a copy of an ISO file that is stored in CDFS format. What type of evidence is this file?
The correct answer is B. data from a CD copied using Linux system. An ISO file in CDFS format indicates a disk image derived from a CD-ROM, and CDFS is primarily associated with Linux or Unix-like systems for mounting such images.
Question
An investigator is examining a copy of an ISO file that is stored in CDFS format. What type of evidence is this file?
Options
- Adata from a CD copied using Mac-based system
- Bdata from a CD copied using Linux system
- Cdata from a DVD copied using Windows system
- Ddata from a CD copied using Windows
How the community answered
(46 responses)- A2% (1)
- B89% (41)
- C7% (3)
- D2% (1)
Why each option
An ISO file in CDFS format indicates a disk image derived from a CD-ROM, and CDFS is primarily associated with Linux or Unix-like systems for mounting such images.
While Mac systems can handle ISOs, CDFS is more strongly associated with the underlying file system standard for CDs (ISO 9660) and its specific implementation/naming in Linux.
CDFS (CD-ROM File System) is the file system used on CD-ROMs, and while Windows can read it, ISO images formatted with CDFS are commonly handled and mounted on Linux systems, which explicitly support and name this file system for optical media.
CDFS is for CD-ROMs, not DVDs, which typically use UDF (Universal Disk Format).
While Windows can read CDFS, it typically refers to a CD-ROM or ISO as having an ISO 9660 file system, and CDFS isn't the primary descriptor for its own native copying utilities; Linux more explicitly references CDFS for mounting CD images.
Concept tested: File System Forensics (CDFS/ISO)
Source: https://www.kernel.org/doc/Documentation/filesystems/cdfs.txt
Topics
Community Discussion
No community discussion yet for this question.