nerdexam
GIAC

GCFA · Question #246

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

The correct answer is A. DriveSpy. DriveSpy is a MS-DOS-based forensic tool capable of generating MD5 hash values for entire drives, partitions, or specific files to verify evidence integrity.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

Options

  • ADriveSpy
  • BOntrack
  • CForensic Sorter
  • DDevice Seizure

How the community answered

(26 responses)
  • A
    85% (22)
  • B
    4% (1)
  • C
    4% (1)
  • D
    8% (2)

Why each option

DriveSpy is a MS-DOS-based forensic tool capable of generating MD5 hash values for entire drives, partitions, or specific files to verify evidence integrity.

ADriveSpyCorrect

DriveSpy, developed by Digital Intelligence, operates through standard MS-DOS commands and provides built-in functionality to compute MD5 hash values for entire drives, individual partitions, or selected files. Its command-line interface and hashing capability make it a trusted forensic tool for creating verified, tamper-evident images of digital evidence.

BOntrack

Ontrack is a commercial data recovery solution focused on retrieving lost or deleted data, not a forensic hashing tool that operates via MS-DOS commands.

CForensic Sorter

Forensic Sorter is designed to organize and categorize files during forensic analysis, not to create MD5 cryptographic hashes of entire drives using MS-DOS commands.

DDevice Seizure

Device Seizure is a Paraben mobile device forensics tool used for extracting data from handheld devices, and does not operate as a drive-level MD5 hashing utility via MS-DOS commands.

Concept tested: Forensic drive imaging and MD5 hash generation tools

Topics

#DriveSpy#MD5 hash#drive imaging#forensic hashing

Community Discussion

No community discussion yet for this question.

Full GCFA Practice