Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?
Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?
Watson is examining a copy of an ISO file stored in CDFS format. CDFS stands for Compact Disc File System, which is a file system used for storing data on CDs. As the question specifies a CD and there is no mention of a specific operating system requirement for creating or reading the ISO file, the most general and accurate answer is that the data originated from a CD. Therefore, 'Data from a CD copied using Windows' is the correct option as it directly relates to the general use of the Compact Disc File System.
CDfs is a virtual file system for Unix-like operating systems; it provides access to data and audio tracks on Compact Discs. When the CDfs driver mounts a Compact Disc, it represents each track as a file. This is consistent with the Unix convention "everything is a file". Answer is D
Think this might just be a bad question. CHFI v10 pg 1096 is only reference in manual to CDFS. The link says "Because CDFS is not specific to a single operating system, a disc burned on a Macintosh using the compact disk file system can be read on a Windows or Linux-based computer." (https://techterms.com/definition/cdfs)
It isn't a bad question, you actually answered it in your quote. It's a disc copied on a Mac-based system. The CDFS (Compact Disk File System) format was originally engineered at MIT in the 80's for use on Macintosh systems.
D < https://en.wikipedia.org/wiki/Compact_Disc_File_System
Windows supports two types of file systems on CD-ROMs and Digital Versatile Disks (DVDs): Compact Disc File System (CDFS) and Universal Disk Format (UDF)
An iso file viewing a copy in cdfs format —> Windows