nerdexam
GIAC

GCFA · Question #277

Which of the following functionality within the Autopsy browser is specifically designed to aid in case management?

The correct answer is C. Image integrity. In Autopsy, the Image Integrity module verifies the hash of forensic disk images to confirm evidence has not been altered, which is essential to case management and chain of custody.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Which of the following functionality within the Autopsy browser is specifically designed to aid in case management?

Options

  • AHash database
  • BFile listing
  • CImage integrity
  • DKeyword searches

How the community answered

(35 responses)
  • A
    6% (2)
  • B
    9% (3)
  • C
    83% (29)
  • D
    3% (1)

Why each option

In Autopsy, the Image Integrity module verifies the hash of forensic disk images to confirm evidence has not been altered, which is essential to case management and chain of custody.

AHash database

Hash databases in Autopsy are used to filter out known good or known bad files by comparing file hashes against sets like NSRL, which is an investigative analysis aid rather than a case management function.

BFile listing

File listing simply enumerates files found within a forensic image and is a general navigation feature, not specifically designed for case management.

CImage integrityCorrect

Image Integrity in Autopsy calculates and verifies the MD5 hash of acquired disk images to confirm the evidence has not been tampered with since acquisition. This directly supports case management by ensuring legal admissibility and maintaining chain of custody documentation. Without verified image integrity, forensic findings could be challenged or rendered inadmissible in legal proceedings.

DKeyword searches

Keyword searches locate specific strings or patterns within a forensic image and serve an investigative analysis purpose, not case management.

Concept tested: Autopsy forensic image integrity for case management

Source: https://sleuthkit.org/autopsy/docs/user-docs/4.18.0/image_integrity_page.html

Topics

#Autopsy#forensic tools#image integrity#case management

Community Discussion

No community discussion yet for this question.

Full GCFA Practice