GCIA · Question #72
Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?
The correct answer is A. DriveSpy. DriveSpy is a DOS-based forensic tool that operates using standard MS-DOS commands and includes the ability to generate MD5 hash values for entire drives, partitions, or individual files.
Question
Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?
Options
- ADriveSpy
- BOntrack
- CDevice Seizure
- DForensic Sorter
How the community answered
(20 responses)- A85% (17)
- B5% (1)
- C10% (2)
Why each option
DriveSpy is a DOS-based forensic tool that operates using standard MS-DOS commands and includes the ability to generate MD5 hash values for entire drives, partitions, or individual files.
DriveSpy, developed by Digital Intelligence, is a command-line forensic utility that runs within a DOS environment and uses familiar MS-DOS command syntax, making it accessible without a graphical interface. It supports MD5 hash generation at the drive, partition, or file level, which is essential for establishing cryptographic integrity of evidence. This combination of DOS-based operation and built-in hashing capability is the defining characteristic that distinguishes DriveSpy from other forensic tools.
Ontrack is primarily a data recovery product suite, not a forensic hashing tool that operates via MS-DOS commands.
Device Seizure is a mobile device forensic tool designed for acquiring data from cell phones and PDAs, not a DOS-based drive hashing utility.
Forensic Sorter is a file categorization and sorting tool used to organize evidence files, not a DOS-based utility for creating MD5 hashes of drives.
Concept tested: DOS-based forensic drive hashing with DriveSpy
Source: https://www.digitalintelligence.com/software/drivespy/
Topics
Community Discussion
No community discussion yet for this question.