Which of the following is a potential problem when creating a message digest for forensic
purposes?
A.
The process is very slow.
B.
The file’s last access time is changed.
C.
The message digest is almost as long as the data string.
D.
One-way hashing technology invalidates message digest processing.
E. a file could be changed during the process
Explanation:
Not D: does not make much sense. The purpose of the one-way hash it to create a message
digest.
Not C.
“To generate a digital signature, the digital signal program passes the file to be sent through a
one-way hash function. This hash function produces a fixed size output from a variable size input.”
Pg. 208 Krutz: The CISSP Prep Guide: Gold Edition.
ans? D
0
0
B. “Note that access-time changes will not be reported if the -md5 option is used since the file is accessed in order to compute the MD5 digest.” http://hayne.net/MacDev/WatchFile/
0
0
A message digest is a one way hash. Depending upon the size of the hdd which is being copied the process could be slow and could take hours. So A could be the answer but then B could also be correct, if the person performing this step is incompetent. For a detailed discussion of this question see here: http://dfarq.homeip.net/2012/01/message-digests-for-forensic-purposes/
0
0