312-49V11 · Question #111
During a forensic investigation, Robert discovers that the attacker modified the file extensions of certain malicious files to make them appear benign. These files were originally executable but had…
The correct answer is C. Autopsy. According to the CHFI v11 objectives under Digital Forensics Review and Anti-Forensics Techniques, attackers frequently use file extension manipulation as an anti-forensic technique to conceal malicious executables by renaming them with harmless-looking extensions such as .txt…
Question
During a forensic investigation, Robert discovers that the attacker modified the file extensions of certain malicious files to make them appear benign. These files were originally executable but had their extensions changed to disguise their true nature. Robert needs to identify and extract these files despite their misleading extensions. Which of the following tools can help Robert detect file extension mismatches and recover the actual file types during the investigation?
Options
- AOSForensics
- BTimestomp
- CAutopsy
- DStegoHunt
How the community answered
(23 responses)- A9% (2)
- B4% (1)
- C74% (17)
- D13% (3)
Explanation
According to the CHFI v11 objectives under Digital Forensics Review and Anti-Forensics Techniques, attackers frequently use file extension manipulation as an anti-forensic technique to conceal malicious executables by renaming them with harmless-looking extensions such as .txt, .jpg, or .pdf. This tactic relies on the assumption that investigators or users will trust the file extension rather than verifying the file's true structure. Autopsy, which is built on The Sleuth Kit (TSK), provides a dedicated capability to detect file extension mismatches by analyzing file headers (magic numbers) and comparing them against the file's extension. If a file's internal signature does not match its extension, Autopsy flags it as suspicious, allowing investigators to identify hidden executables and recover their true file types. CHFI v11 explicitly highlights "Detecting File Extension Mismatch using Autopsy" as a key forensic technique for defeating anti-forensics.
Topics
Community Discussion
No community discussion yet for this question.