Rachel, a forensic investigator, is examining a network-attached storage (NAS) device to recover files from a shared storage system used by a company. She needs to understand how files are being…

Question

Options

• ASMTP
• BiSCSI
• CRAID
• DSMB/CIFS

• A
  14% (5)
• B
  8% (3)
• C
  3% (1)
• D
  76% (28)

Explanation

According to the CHFI v11 objectives under Digital Evidence, Operating System Forensics, and Network-Based Evidence, understanding file-sharing protocols is essential when investigating Network-Attached Storage (NAS) systems. NAS devices are designed to provide shared file access to multiple users over a network, and the most commonly used protocol for this purpose-- especially in Windows-based and mixed environments--is SMB/CIFS (Server Message Block / Common Internet File System). SMB/CIFS governs how files, folders, printers, and other resources are accessed and shared across the network. By examining SMB/CIFS activity, a forensic investigator can determine which users accessed specific files, when the access occurred, what operations were performed (read, write, delete), and from which systems the access originated. These details are crucial for reconstructing user activity, identifying unauthorized access, and correlating actions across multiple endpoints connected to the NAS.

No community discussion yet for this question.