Exam 312-49v10 topic 1 question 714 discussion

EC-Council. (2021-03-01). Computer Hacking Forensics Investigator (CHFI) Version 10, 10th Edition. [[VitalSource Bookshelf version]]. Retrieved from vbk://9781635676969 Module 05 Defeating Anti-forensics Techniques Page 519 "Using this technique, the attacker can hide the evidence files into containers, thereby making them hard to detect. Therefore, during forensic investigations, the investigator’s first approach should be to mount compound files. Program packers that are password-protected can pose a challenge during investigation as investigators need to first decrypt the password to unpack the file." ----- mount compound files first UNLESS password-protected THEN first decrypt the password

the investigator’s first approach should be to mount compound files.

Program packers are used by attackers to hide their data. In this regard, the technique is similar to cryptography. The packers compress the files using various algorithms. Hence, unless the investigators know the tool that has been used to pack the file and have a tool to unpack it, they will not be able to access it. Using this technique, the attacker can hide the evidence files into containers, thereby making them hard to detect. Therefore, during forensic investigations, the investigator’s first approach should be to mount compound files. Program packers that are password-protected can pose a challenge during investigation as investigators need to first decrypt the password to unpack the file.