GCIH · Question #644
Which of the following is a technique that can be used to reduce the amount of data to examine during an investigation?
The correct answer is A. Ignore files with known good hashes. During an investigation, analysts can reduce the volume of files to examine by skipping files whose hashes match known-good baselines, focusing effort only on unknown or suspicious files.
Question
Which of the following is a technique that can be used to reduce the amount of data to examine during an investigation?
Options
- AIgnore files with known good hashes
- BIgnore malicious file hashes
- CCreate file hashes for all directories on the system
- DRequest management recommendation for file hashes of interest
How the community answered
(27 responses)- A93% (25)
- B4% (1)
- C4% (1)
Why each option
During an investigation, analysts can reduce the volume of files to examine by skipping files whose hashes match known-good baselines, focusing effort only on unknown or suspicious files.
Known-good hash databases (such as NIST NSRL) allow analysts to quickly identify and skip legitimate system files, dramatically reducing the number of files requiring manual review. This technique, called hash filtering or allow-listing, is a standard triage method in digital forensics that lets investigators focus on files that cannot be verified as benign.
Ignoring malicious hashes would cause analysts to skip exactly the files they need to examine, not reduce benign noise.
Creating hashes for all directories generates more data to manage but does not reduce the investigation scope by itself.
Requesting management recommendations is an administrative action and has no technical impact on reducing the dataset under analysis.
Concept tested: Hash-based file triage in digital forensics
Source: https://www.nist.gov/system-files/documents/2017/07/06/draft-nist-sp-1800-8-nsrl_sept_2016_0.pdf
Topics
Community Discussion
No community discussion yet for this question.