You create two evidence images from the suspect's drive: suspect.E01 and suspect.001. You want to be able to verify that the image hash values are the same for suspect.E01 and suspect.001 image…

Question

Options

• Asuspect.001.txt
• Bsuspect.E01.txt
• Csuspect.001.csv
• Dsuspect.E01.csv

• A
  71% (20)
• B
  18% (5)
• C
  4% (1)
• D
  7% (2)

Explanation

Option A is correct because forensic imaging tools that create Raw (dd) format images - where segments are named .001, .002, etc. - store the accompanying hash verification data in a plain text file named suspect.001.txt. This .txt file contains the MD5 and/or SHA1 hash of the raw image so investigators can verify integrity.

Why the distractors are wrong:

• B (suspect.E01.txt) is the log/verification file for the EnCase format image, not the raw dd image - it belongs to the wrong image type.
• C (suspect.001.csv) uses the correct image prefix but the wrong extension - hash files for raw images use .txt, not .csv.
• D (suspect.E01.csv) is doubly wrong: it references the EnCase image and uses a .csv extension, which neither format uses for hash storage.

Memory tip: Match the hash file to its image by prefix - the raw dd image (suspect.001) pairs with suspect.001.txt, and the EnCase image (suspect.E01) pairs with suspect.E01.txt. When in doubt, follow the name - the .txt always tags along with its own image type.

No community discussion yet for this question.