GCFA · Question #277
Which of the following functionality within the Autopsy browser is specifically designed to aid in case management?
The correct answer is C. Image integrity. In Autopsy, the Image Integrity module verifies the hash of forensic disk images to confirm evidence has not been altered, which is essential to case management and chain of custody.
Question
Which of the following functionality within the Autopsy browser is specifically designed to aid in case management?
Options
- AHash database
- BFile listing
- CImage integrity
- DKeyword searches
How the community answered
(35 responses)- A6% (2)
- B9% (3)
- C83% (29)
- D3% (1)
Why each option
In Autopsy, the Image Integrity module verifies the hash of forensic disk images to confirm evidence has not been altered, which is essential to case management and chain of custody.
Hash databases in Autopsy are used to filter out known good or known bad files by comparing file hashes against sets like NSRL, which is an investigative analysis aid rather than a case management function.
File listing simply enumerates files found within a forensic image and is a general navigation feature, not specifically designed for case management.
Image Integrity in Autopsy calculates and verifies the MD5 hash of acquired disk images to confirm the evidence has not been tampered with since acquisition. This directly supports case management by ensuring legal admissibility and maintaining chain of custody documentation. Without verified image integrity, forensic findings could be challenged or rendered inadmissible in legal proceedings.
Keyword searches locate specific strings or patterns within a forensic image and serve an investigative analysis purpose, not case management.
Concept tested: Autopsy forensic image integrity for case management
Source: https://sleuthkit.org/autopsy/docs/user-docs/4.18.0/image_integrity_page.html
Topics
Community Discussion
No community discussion yet for this question.