312-49V11 · Question #151
A CHFI expert creates a forensics image of a pen drive using AccessData FTK Imager during a computer forensics investigation. The investigator uses The Sleuth Kit (TSK) to examine an ext4 file…
The correct answer is D. istat -B num. In TSK, istat displays inode metadata. The -B option shows the list of allocated block addresses associated with that inode. This is exactly what's needed to examine unexpected block allocation patterns and detect tampering.
Question
A CHFI expert creates a forensics image of a pen drive using AccessData FTK Imager during a computer forensics investigation. The investigator uses The Sleuth Kit (TSK) to examine an ext4 file system on a Linux disk image and suspects data tampering. The expert decides to verify inode metadata for a critical file. However, he notes an unexpected block allocation in the inode details. Which TSK command-line tool and argument should the investigator utilize to examine the addresses of all allocated disk units for the suspicious inode?
Options
- Afsstat -f ext4
- Bimg_stat -i raw
- Cfls -o imgoffset
- Distat -B num
How the community answered
(48 responses)- A4% (2)
- B8% (4)
- C17% (8)
- D71% (34)
Explanation
In TSK, istat displays inode metadata. The -B option shows the list of allocated block addresses associated with that inode. This is exactly what's needed to examine unexpected block allocation patterns and detect tampering.
Topics
Community Discussion
No community discussion yet for this question.