nerdexam
GIAC

GCFA · Question #285

Which of the following cryptographic methods are used in EnCase to ensure the integrity of the data, which is acquired for the investigation? Each correct answer represents a complete solution. Choose

The correct answer is A. MD5 B. CRC. EnCase uses MD5 hashing and CRC32 checksums to verify that acquired forensic evidence has not been altered. These two methods together provide both block-level and image-level integrity verification.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Which of the following cryptographic methods are used in EnCase to ensure the integrity of the data, which is acquired for the investigation? Each correct answer represents a complete solution. Choose two.

Options

  • AMD5
  • BCRC
  • CHAVAL
  • DTwofish

How the community answered

(24 responses)
  • A
    83% (20)
  • C
    13% (3)
  • D
    4% (1)

Why each option

EnCase uses MD5 hashing and CRC32 checksums to verify that acquired forensic evidence has not been altered. These two methods together provide both block-level and image-level integrity verification.

AMD5Correct

MD5 generates a 128-bit hash of the entire acquired image, allowing investigators to verify that the evidence file is an exact bit-for-bit copy of the original. EnCase computes and records this hash at acquisition time and recomputes it during verification to detect any tampering.

BCRCCorrect

CRC (Cyclic Redundancy Check) is used at the block level within EnCase evidence files (.E01) to verify the integrity of each 64-sector data block. This provides granular integrity checking so that corruption can be detected and located within the image.

CHAVAL

HAVAL is a cryptographic hash function but it is not implemented in EnCase as one of its integrity verification mechanisms.

DTwofish

Twofish is a symmetric block cipher used for encryption, not a hashing or integrity verification algorithm, and is not used in EnCase for evidence integrity.

Concept tested: EnCase forensic image integrity verification methods

Source: https://www.opentext.com/products/encase-forensic

Topics

#EnCase#MD5#CRC#forensic data integrity

Community Discussion

No community discussion yet for this question.

Full GCFA Practice