312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

During a Linux malware-persistence investigation, an analyst needs to verify whether a critical executable has been modified since deployment. The task requires generating a value from the file that can be compared with a trusted reference to evaluate its integrity by using a Python-based forensic utility.

Which script should be used to carry out this verification?

A Reboot_history.py
B SystemLog_entries.py
C hash_calculation.py
D volatile_info.py

Explanation

A cryptographic hash derived from a file’s contents provides a digest that can be compared with a trusted reference digest to detect alteration. Python’s hashlib supports hashing file contents; therefore, the utility intended for this purpose is hash_calculation.py.

Learn more

hashlib — Secure hashes and message digests

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ446

Community Discussion