GIAC Exam GCED Topic 1 Question 62 Discussion

Actual exam question for GIAC's GCED exam

Question #: 62
Topic #: 1

[All GCED Questions]

Which of the following is the best way to establish and verify the integrity of a file before copying it during an investigation?

AWrite down the file size of the file before and after copying and ensure they match

BEnsure that the MAC times are identical before and after copying the file

CEstablish the chain of custody with the system description to prove it is the same image

DCreate hash of the file before and after copying the image verifying they are identical

Show Suggested Answer

Suggested Answer: D

by Shawana at Apr 07, 2025, 09:55 PM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Theola

1 months ago

Option D is the clear winner here. Anything else just seems like a half-measure. You can't go wrong with a good old-fashioned hash.

upvoted 0 times

Sharmaine

2 days ago

User 3: It's important to ensure that the hash values match to confirm the file's integrity.

upvoted 0 times

...

Chara

4 days ago

User 2: Creating a hash of the file before and after copying is definitely the most reliable method.

upvoted 0 times

...

Sophia

10 days ago

User 1: I agree, option D is the best way to establish and verify the integrity of a file.

upvoted 0 times

...

Allene

1 months ago

Hashing is the way to go, but I have to admit, it's kind of a fun word to say. 'Hash' - it just rolls off the tongue, doesn't it?

upvoted 0 times

...

Denny

1 months ago

Hashing is the gold standard for file integrity verification. It's the only way to ensure that even the smallest change won't slip by unnoticed.

upvoted 0 times

Linn

4 days ago

C) Establish the chain of custody with the system description to prove it is the same image

upvoted 0 times

...

Dexter

16 days ago

D) Create hash of the file before and after copying the image verifying they are identical

upvoted 0 times

...

Gracia

1 months ago

A) Write down the file size of the file before and after copying and ensure they match

upvoted 0 times

...

Terrilyn

2 months ago

I agree, hashing the file is the only way to truly verify that the copied file is identical to the original. The other options might work in some cases, but hashing is the most reliable.

upvoted 0 times

...

Lamar

2 months ago

Option D is definitely the way to go. Creating hash values before and after the copy ensures that the file integrity is maintained. This is a standard forensic practice.

upvoted 0 times

Kip

16 days ago

User 3: It's important to have a solid method like that in place to ensure the integrity of the file during investigations.

upvoted 0 times

...

Caitlin

24 days ago

User 2: I agree, creating a hash of the file is a reliable way to verify its integrity.

upvoted 0 times

...

Audry

1 months ago

User 1: Option D is definitely the way to go. Creating hash values before and after the copy ensures that the file integrity is maintained. This is a standard forensic practice.

upvoted 0 times

...