Question

block-wise hashing has which of the following benefits for forensics examiners?
a. allows validating sector comparisons between known files
b. provides a faster way to shift bits in a block or sector of data
c. verifies the quality of os files
d. provides a method for hashing sectors of a known good file that can be used to search for data remnan

Explanation:

Block-wise hashing splits data into blocks/sectors and generates hashes for each. For forensics, this allows examiners to hash sectors of a known good file, then use those sector hashes to search for residual data fragments (like partial file remains) on storage media, which is a key forensic use case. Option a is incorrect because it focuses on validating comparisons rather than the core forensic benefit of searching for remnants. Option b is wrong as bit shifting is not a benefit of block-wise hashing. Option c is incorrect since it does not verify OS file quality.

Answer:

d. Provides a method for hashing sectors of a known good file that can be used to search for data remnants