Free Preparation Discussions
MENU
CompTIA Exam CAS-004 Topic 1 Question 48 Discussion
Topic #: 1
A forensics investigator is analyzing an executable file extracted from storage media that was submitted (or evidence The investigator must use a tool that can identify whether the executable has indicators, which may point to the creator of the file Which of the following should the investigator use while preserving evidence integrity?
ssdeep is a tool that computes and matches Context Triggered Piecewise Hashing (CTPH), also known as fuzzy hashing. It can be used to identify similar files or slight variations of the same file, which may point to the creator of the file if certain patterns or markers are consistently present. This method allows for integrity checking without altering the evidence, which is critical in forensic investigation.
Kerrie
11 months agoShalon
11 months agoAmos
12 months agoKerrie
12 months agoLettie
1 years agoDean
1 years agoMattie
1 years agoLettie
1 years agoMira
1 years agoAlaine
1 years agoShenika
1 years agoXochitl
1 years agoGlenn
1 years agoBarrie
1 years agoFallon
1 years ago