Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space. What type of test would confirm his

The correct answer is A. File fingerprinting. File fingerprinting involves generating cryptographic hash values (e.g., MD5, SHA-256) for files to detect duplication and unauthorized copies. If malware is replicating files, fingerprinting will reveal multiple files with identical hashes, confirming that copies are being made.

Submitted by jordan8· Apr 18, 2026Malware Forensics

Question

Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the available disk space. What type of test would confirm his claim?

Options

AFile fingerprinting
BIdentifying file obfuscation
CStatic analysis
DDynamic analysis

How the community answered

(33 responses)

A
79% (26)
B
3% (1)
C
6% (2)
D
12% (4)

Explanation

File fingerprinting involves generating cryptographic hash values (e.g., MD5, SHA-256) for files to detect duplication and unauthorized copies. If malware is replicating files, fingerprinting will reveal multiple files with identical hashes, confirming that copies are being made. This technique can also track new files appearing over time. Dynamic analysis observes running behavior but is broader; static analysis examines code without execution; and identifying file obfuscation targets hidden or disguised files - none are as directly suited as fingerprinting for detecting file duplication.

Topics

#File analysis#Malware investigation#Hashing#Data duplication

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice