FTK’s Known File Filter (KFF) can be used for which of the following purposes? (Choose all that apply.)
a. Filter known program files from view.
b. Calculate hash values of image files.
c. Compare hash values of known files to evidence files.
d. Filter out evidence that doesn’t relate to your investigation.
For what legal and illegal purposes can you use steganography? Password recovery is included in all computer forensics tools. True or False?
The Correct Answer and Explanation is :
Answers:
- FTK’s Known File Filter (KFF) can be used for:
- a. Filter known program files from view.
- c. Compare hash values of known files to evidence files.
- For what legal and illegal purposes can you use steganography?
- Legal purposes: Secure communication, protecting copyright information, embedding watermarks in digital media.
- Illegal purposes: Concealing criminal activities, hiding malware or spyware, evading censorship.
- Password recovery is included in all computer forensics tools.
- False.
Explanation:
FTK’s Known File Filter (KFF):
The Known File Filter (KFF) in AccessData’s Forensic Toolkit (FTK) is primarily used to help forensic investigators manage and filter out known files from their investigation to focus on potentially relevant data. Option (a) is correct as it allows investigators to filter out known good files (like system files and applications) that are not related to the investigation. Option (c) is also correct because KFF can compare hash values of files from the current case to a database of known file hashes (both good and bad), helping identify known files quickly. Option (b) is not a direct function of KFF, as hash value calculation is a general feature of forensic tools, not specific to KFF. Option (d) is misleading because while filtering out irrelevant data is a goal, KFF specifically filters based on known file hashes, not broader criteria of relevance to the case.
Steganography Usage:
Steganography, the practice of hiding information within other non-secret text or data, can be used legally for protecting intellectual property, ensuring secure communications, or embedding digital watermarks. Illegally, it can be used to conceal criminal communications, hide data exfiltration within seemingly innocuous files, or embed malicious code within other files.
Password Recovery:
The statement that password recovery features are included in all computer forensics tools is false. While many forensic tools have capabilities for recovering or bypassing passwords, not all tools are equipped with this feature, as their focus and functionalities can vary widely depending on their design and intended forensic tasks.
Image Generation:
I will generate an image that visually represents the concept of steganography, illustrating both its legal and illegal uses.
Here is the image depicting the concept of steganography, illustrating both its legal and illegal uses. The left side shows a legal scenario of watermarking digital images, while the right side portrays the illegal use involving concealed communications. Feel free to take a closer look at the details!
