A forensics ana

lyst suspects that a breach has occurred. Security logs show the company-s OS patch system may be compromised, and it is serving patches that contain a zero-day exploit and backdoor. The analyst extracts an executable file from a packet capture of communic

ation between a client computer and the patch server. Which of the following should the analyst use to confirm this suspicion?

A. File size

B. Digital signature

C. Checksums

D. Anti-malware software

E. Sandboxing