nerdexam
GIAC

GCIA · Question #72

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

The correct answer is A. DriveSpy. DriveSpy is a DOS-based forensic tool that operates using standard MS-DOS commands and includes the ability to generate MD5 hash values for entire drives, partitions, or individual files.

Network Forensics, Protocol Insecurity & Evasion Techniques

Question

Which of the following tools works by using standard set of MS-DOS commands and can create an MD5 hash of an entire drive, partition, or selected files?

Options

  • ADriveSpy
  • BOntrack
  • CDevice Seizure
  • DForensic Sorter

How the community answered

(20 responses)
  • A
    85% (17)
  • B
    5% (1)
  • C
    10% (2)

Why each option

DriveSpy is a DOS-based forensic tool that operates using standard MS-DOS commands and includes the ability to generate MD5 hash values for entire drives, partitions, or individual files.

ADriveSpyCorrect

DriveSpy, developed by Digital Intelligence, is a command-line forensic utility that runs within a DOS environment and uses familiar MS-DOS command syntax, making it accessible without a graphical interface. It supports MD5 hash generation at the drive, partition, or file level, which is essential for establishing cryptographic integrity of evidence. This combination of DOS-based operation and built-in hashing capability is the defining characteristic that distinguishes DriveSpy from other forensic tools.

BOntrack

Ontrack is primarily a data recovery product suite, not a forensic hashing tool that operates via MS-DOS commands.

CDevice Seizure

Device Seizure is a mobile device forensic tool designed for acquiring data from cell phones and PDAs, not a DOS-based drive hashing utility.

DForensic Sorter

Forensic Sorter is a file categorization and sorting tool used to organize evidence files, not a DOS-based utility for creating MD5 hashes of drives.

Concept tested: DOS-based forensic drive hashing with DriveSpy

Source: https://www.digitalintelligence.com/software/drivespy/

Topics

#DriveSpy#MD5 hash#forensic imaging#drive acquisition

Community Discussion

No community discussion yet for this question.

Full GCIA Practice