312-49V11 · Question #113
Investigators may encounter issues with image file compatibility after acquiring data from suspect media. This section outlines scenarios like converting E01 format for Linux, creating a bootable…
The correct answer is B. Handling APFS file systems on a Windows workstation. According to the CHFI v11 objectives under Image/Evidence Examination and Operating System Forensics, one of the most significant challenges investigators face when preparing image files for examination is file system compatibility across operating systems. APFS (Apple File…
Question
Investigators may encounter issues with image file compatibility after acquiring data from suspect media. This section outlines scenarios like converting E01 format for Linux, creating a bootable VM, dealing with Windows file systems on Linux, and handling APFS file systems. Solutions for each scenario are discussed, concluding with image viewing methods for Windows, Linux, and Mac. What challenges might investigators face when preparing image files for examination?
Options
- AConverting E01 format for Windows
- BHandling APFS file systems on a Windows workstation
- CCreating a bootable VM from acquired evidence
- DViewing image files on a Mac workstation
How the community answered
(32 responses)- A13% (4)
- B78% (25)
- C3% (1)
- D6% (2)
Explanation
According to the CHFI v11 objectives under Image/Evidence Examination and Operating System Forensics, one of the most significant challenges investigators face when preparing image files for examination is file system compatibility across operating systems. APFS (Apple File System) is the default file system used by modern macOS devices, and it is not natively supported on Windows workstations. This creates a clear challenge when investigators attempt to analyze APFS-based forensic images on Windows platforms. CHFI v11 highlights that special tools, drivers, or forensic platforms are required to mount, parse, and analyze APFS volumes on non-macOS systems. Without proper support, investigators may be unable to access directories, metadata, snapshots, or encrypted APFS containers, potentially delaying investigations or risking incomplete analysis.
Topics
Community Discussion
No community discussion yet for this question.