nerdexam
GIAC

GCFA · Question #121

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used in

The correct answer is B. iso image file. Forensic Sorter supports standard hard drive forensic image formats but does not support ISO image files, which are optical disc images rather than hard drive forensic images.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used in cyber crime. Adam uses Forensic Sorter to sort the contents of hard drive in different categories. Which of the following type of image formats is NOT supported by Forensic Sorter?

Options

  • APFR image file
  • Biso image file
  • CRAW image file
  • DEnCase image file

How the community answered

(52 responses)
  • A
    6% (3)
  • B
    77% (40)
  • C
    13% (7)
  • D
    4% (2)

Why each option

Forensic Sorter supports standard hard drive forensic image formats but does not support ISO image files, which are optical disc images rather than hard drive forensic images.

APFR image file

PFR (Paraben Forensic Replicator) image files are a recognized proprietary forensic image format that Forensic Sorter supports for hard drive examination.

Biso image fileCorrect

ISO image files are optical disc image formats designed for CD/DVD media, not for forensic hard drive investigations. Forensic Sorter is built to process forensic disk image formats such as RAW, EnCase (E01), and PFR - ISO optical disc images fall outside this scope and are not supported.

CRAW image file

RAW image format (also known as dd format) is one of the most common and universally supported forensic disk image formats and is fully supported by Forensic Sorter.

DEnCase image file

EnCase image format (E01) is a widely used proprietary forensic disk image format that Forensic Sorter fully supports for analysis and examination.

Concept tested: Forensic Sorter supported disk image file formats

Topics

#Forensic Sorter#disk image formats#forensic imaging#EnCase

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice