QuestionQ15

Tools/Systems/Programs

You are a forensic analyst investigating a possible cyberattack on a bank’s network. You have been given an image of the suspected machine for examination. To ensure a thorough investigation, you chose Autopsy for file-system analysis. However, the image is huge, and manually sifting through the data could take weeks. Which Autopsy feature can be used to speed up the analysis process?

  • A File carving
  • B Keyword search
  • C Timeline analysis
  • D Image mounting
Explanation

Keyword search locates files and artifacts containing relevant investigator-defined terms across the file system, reducing the amount of data that must be reviewed manually.

Community Discussion

No comments yet. Be the first to start the discussion!