GIAC Exam GCED Topic 1 Question 49 Discussion

Actual exam question for GIAC's GCED exam

Question #: 49
Topic #: 1

Which of the following is the best way to establish and verify the integrity of a file before copying it during an investigation?

AWrite down the file size of the file before and after copying and ensure they match

BEnsure that the MAC times are identical before and after copying the file

CEstablish the chain of custody with the system description to prove it is the same image

DCreate hash of the file before and after copying the image verifying they are identical

Show Suggested Answer

Suggested Answer: D

by Helaine at Sep 19, 2024, 11:37 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Belen

3 months ago

Option D sounds like the best option, but let's be real here - who really wants to be the one responsible for verifying file integrity? That's like being the hall monitor of the digital world.

upvoted 0 times

...

Jody

3 months ago

I'm with Marisha on this one. Option D is the way to go. Establishing the hash is the most reliable way to ensure the file's integrity. It's like a digital notary for your file.

upvoted 0 times

An

2 months ago

Option D is definitely the best choice for ensuring the file's integrity. It's like a digital fingerprint for the file.

upvoted 0 times

...

Truman

2 months ago

Yeah, I always make sure to create a hash before and after copying any important files. It's a crucial step in investigations.

upvoted 0 times

...

Darnell

2 months ago

I agree with you, creating a hash of the file is definitely the most reliable way to verify its integrity.

upvoted 0 times

...

Marisha

4 months ago

Option D all the way! Hash matching is the gold standard for file integrity verification. It's like a digital handshake to make sure the file didn't get any 'digital cooties' during the transfer.

upvoted 0 times

Hubert

2 months ago

D) Create hash of the file before and after copying the image verifying they are identical

upvoted 0 times

...

Martin

3 months ago

C) Establish the chain of custody with the system description to prove it is the same image

upvoted 0 times

...

Anika

3 months ago

B) Ensure that the MAC times are identical before and after copying the file

upvoted 0 times

...

Audry

3 months ago

A) Write down the file size of the file before and after copying and ensure they match

upvoted 0 times

...

William

4 months ago

I prefer option A, writing down the file size before and after copying.

upvoted 0 times

...

Micaela

4 months ago

Hmm, I don't know. Wouldn't option C be good too? The chain of custody and system description could help prove it's the same file, right?

upvoted 0 times

Johnathon

3 months ago

D) Create hash of the file before and after copying the image verifying they are identical

upvoted 0 times

...

Elbert

3 months ago

C) Establish the chain of custody with the system description to prove it is the same image

upvoted 0 times

...

Malika

3 months ago

B) Ensure that the MAC times are identical before and after copying the file

upvoted 0 times

...

Jules

3 months ago

A) Write down the file size of the file before and after copying and ensure they match

upvoted 0 times

...

Xuan

4 months ago

I agree with Wai, creating a hash is the most reliable way to verify integrity.

upvoted 0 times

...

Camellia

4 months ago

Option D is the way to go. Creating a hash before and after copying is the best way to verify the file's integrity. That's like a digital fingerprint for the file.

upvoted 0 times

Talia

4 months ago

I agree, creating a hash before and after copying is crucial for verifying the integrity of the file.

upvoted 0 times

...

Eric

4 months ago

Option D is definitely the most reliable method. It's like a digital fingerprint for the file.

upvoted 0 times

...

Wai

4 months ago

I think the best way is to create a hash of the file before and after copying.

upvoted 0 times

...