How can a forensic specialist exclude from examination a large percentage of operating system files residing on a copy of the target system?

Question

Bruno Soriano · Accepted Answer

Create a comparison database of cryptographic hashes of the files from a system with the same operating system and patch level.

Bruno Soriano · Answer

Take another backup of the media in question then delete all irrelevant operating system files.

Bruno Soriano · Answer

Generate a message digest (MD) or secure hash on the drive image to detect tampering of the media being examined.

Bruno Soriano · Answer

Discard harmless files for the operating system, and known installed programs.

List of questions