312-49 · Question #491
Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?
The correct answer is A. Data from a CD copied using Windows. CDFS (Compact Disc File System) is the file system Windows uses to read and write standard CDs (ISO 9660 standard). When a CD is copied or imaged on a Windows system, the resulting ISO retains the CDFS structure. Mac systems typically use HFS+/APFS for disc imaging, Linux tools…
Question
Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?
Options
- AData from a CD copied using Windows
- BData from a CD copied using Mac-based system
- CData from a DVD copied using Windows system
- DData from a CD copied using Linux system
How the community answered
(33 responses)- A94% (31)
- B3% (1)
- C3% (1)
Explanation
CDFS (Compact Disc File System) is the file system Windows uses to read and write standard CDs (ISO 9660 standard). When a CD is copied or imaged on a Windows system, the resulting ISO retains the CDFS structure. Mac systems typically use HFS+/APFS for disc imaging, Linux tools like dd produce raw images without necessarily preserving a CDFS label, and DVDs use UDF (Universal Disc Format) rather than CDFS. The CDFS format therefore specifically indicates a Windows-based CD copy.
Topics
Community Discussion
No community discussion yet for this question.