Which capability is listed for OS Forensics?

Which capability is listed for OS Forensics?

• A. Hash matching to identify suspicious files
• B. Cloud data migration
• C. Social engineering campaigns
• D. Real-time antivirus scanning

Answer: (A)

Hash matching is a core capability for OS Forensics. It involves generating cryptographic hashes (like MD5, SHA-1, or SHA-256) for files and then comparing those hashes to known databases of legitimate or malicious file fingerprints. This lets investigators quickly identify suspicious or known-malicious files, confirm file integrity, and spot duplicates across large datasets without manually inspecting every item. The other options describe activities that aren’t typical forensic analysis features—cloud data migration is about moving data to or between clouds, social engineering campaigns are about manipulating people, and real-time antivirus scanning is a live protection function rather than evidence examination.

Hash matching is a core capability for OS Forensics. It involves generating cryptographic hashes (like MD5, SHA-1, or SHA-256) for files and then comparing those hashes to known databases of legitimate or malicious file fingerprints. This lets investigators quickly identify suspicious or known-malicious files, confirm file integrity, and spot duplicates across large datasets without manually inspecting every item. The other options describe activities that aren’t typical forensic analysis features—cloud data migration is about moving data to or between clouds, social engineering campaigns are about manipulating people, and real-time antivirus scanning is a live protection function rather than evidence examination.