GCFA · Question #246
Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?
The correct answer is A. DriveSpy. DriveSpy is a MS-DOS-based forensic tool capable of generating MD5 hash values for entire drives, partitions, or specific files to verify evidence integrity.
Question
Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?
Options
- ADriveSpy
- BOntrack
- CForensic Sorter
- DDevice Seizure
How the community answered
(26 responses)- A85% (22)
- B4% (1)
- C4% (1)
- D8% (2)
Why each option
DriveSpy is a MS-DOS-based forensic tool capable of generating MD5 hash values for entire drives, partitions, or specific files to verify evidence integrity.
DriveSpy, developed by Digital Intelligence, operates through standard MS-DOS commands and provides built-in functionality to compute MD5 hash values for entire drives, individual partitions, or selected files. Its command-line interface and hashing capability make it a trusted forensic tool for creating verified, tamper-evident images of digital evidence.
Ontrack is a commercial data recovery solution focused on retrieving lost or deleted data, not a forensic hashing tool that operates via MS-DOS commands.
Forensic Sorter is designed to organize and categorize files during forensic analysis, not to create MD5 cryptographic hashes of entire drives using MS-DOS commands.
Device Seizure is a Paraben mobile device forensics tool used for extracting data from handheld devices, and does not operate as a drive-level MD5 hashing utility via MS-DOS commands.
Concept tested: Forensic drive imaging and MD5 hash generation tools
Topics
Community Discussion
No community discussion yet for this question.