Question

the exterros accessdata known file filter (kff) database can be used for which of the following purposes? (choose all that apply.)
a. filter known program files from view.
b. calculate hash values of image files.
c. compare hash values of known files with evidence files.
d. filter out evidence that doesnt relate to your investigation.

Explanation:

The Known File Filter (KFF) database in digital forensics is designed to manage known files via hash comparisons and filtering.

• Option a: It filters known program files by matching their hashes to the database, removing them from view.
• Option b: Calculating hash values is done by hashing tools, not the KFF database itself.
• Option c: KFF uses hash sets of known files to compare against evidence files to identify matches.
• Option d: By filtering out known, non-relevant files, it effectively removes evidence unrelated to the investigation.

Answer:

a. Filter known program files from view.
c. Compare hash values of known files with evidence files.
d. Filter out evidence that doesn't relate to your investigation.