nerdexam
GIAC

GCED · Question #45

Which of the following is the best way to establish and verify the integrity of a file before copying it during an investigation?

The correct answer is D. Create hash of the file before and after copying the image verifying they are identical. You've hit your limit · resets 1pm (America/New_York)

Data Protection and Incident Response

Question

Which of the following is the best way to establish and verify the integrity of a file before copying it during an investigation?

Options

  • AWrite down the file size of the file before and after copying and ensure they match
  • BEnsure that the MAC times are identical before and after copying the file
  • CEstablish the chain of custody with the system description to prove it is the same image
  • DCreate hash of the file before and after copying the image verifying they are identical

How the community answered

(32 responses)
  • A
    3% (1)
  • C
    6% (2)
  • D
    91% (29)

Explanation

You've hit your limit · resets 1pm (America/New_York)

Topics

#file integrity#hashing#forensic investigation#chain of custody

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCED Practice