nerdexam
GIAC

GCIA · Question #47

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used…

The correct answer is D. iso image file. Forensic Sorter supports standard forensic disk image formats such as EnCase, PFR, and RAW, but does not support ISO image files, which are optical disc formats rather than hard drive forensic images.

Network Forensics, Protocol Insecurity & Evasion Techniques

Question

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used in cyber crime. Adam uses Forensic Sorter to sort the contents of hard drive in different categories. Which of the following type of image formats is NOT supported by Forensic Sorter?

Options

  • AEnCase image file
  • BPFR image file
  • CRAW image file
  • Diso image file

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    5% (1)
  • C
    11% (2)
  • D
    79% (15)

Why each option

Forensic Sorter supports standard forensic disk image formats such as EnCase, PFR, and RAW, but does not support ISO image files, which are optical disc formats rather than hard drive forensic images.

AEnCase image file

EnCase image files (.E01) are a widely used proprietary forensic format created by Guidance Software and are natively supported by Forensic Sorter.

BPFR image file

PFR (ProDiscover Forensic) image files are a recognized forensic disk image format and are supported by Forensic Sorter for analysis.

CRAW image file

RAW (dd-style) image files are a flat binary forensic format supported by virtually all forensic analysis tools, including Forensic Sorter.

Diso image fileCorrect

ISO files are optical disc image formats used to represent CD or DVD content and are not forensic hard drive image formats. Forensic Sorter is designed to analyze forensic disk captures of hard drives, and ISO is outside its supported format set because it represents a fundamentally different type of storage media image.

Concept tested: Forensic Sorter supported disk image formats

Topics

#digital forensics#disk image formats#forensic tools#evidence acquisition

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIA Practice