Chong-lee, a forensics executive, suspects that a malware is continuously making copies of files and folders on a victim system to consume the…

File fingerprinting, also known as file hashing, is the process of generating a unique cryptographic hash value (e.g., MD5, SHA-256) for a file. This hash serves as a unique identifier or "fingerprint." To confirm the suspicion that malware is creating copies of files, an investigator would hash all files on the victim system. Files with identical hash values are exact duplicates, regardless of their names or locations. By identifying a large number of duplicate files, Chong-lee can confirm his claim that the malware's purpose is to consume disk space by continuously making copies. This method directly analyzes the state of the compromised disk to find evidence of file duplication.

B. Identifying file obfuscation: This technique analyzes how malware code is scrambled to evade detection; it does not identify duplicate files on a system.

C. Static analysis: This involves examining malware code without executing it. It can reveal the capability to copy files but does not confirm that this action has actually occurred on the victim system.

D. Dynamic analysis: This involves running the malware in a controlled environment (sandbox) to observe its behavior, not analyzing the existing state of a compromised disk for evidence.

1. National Institute of Standards and Technology (NIST). (2006). Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response.

Section 3.3.1, File Hashing: "Hashing can also be used to find duplicate files on a system. For example, an investigator might want to find all instances of a particular file on a system. Hashing all files on the system and looking for matches to the particular file’s hash is much more efficient than doing a file-by-file comparison."

2. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional.

Chapter 10, Content Category, Section: File Hashes: This chapter details the use of hash algorithms to uniquely identify the content of a file. It explains that if two files have the same hash value, their contents are identical, which is the fundamental principle used to detect duplicate files during a forensic investigation.

3. Maras, M. H. (2014). Computer Forensics: Cybercriminals, Laws, and Evidence. Jones & Bartlett Learning.

Chapter 7, Digital Evidence, Page 188: "Hashing is also used to identify duplicate files... By creating a hash value for each file on a hard drive, it is possible to identify files that are identical, even if they have different names." This directly supports using hashing (fingerprinting) to confirm the presence of copied files.