What type of evidence is this file?

An investigator is examining a copy of an ISO file that is stored in CDFS format.

What type of evidence is this file?
A . data from a CD copied using Mac-based system
B . data from a CD copied using Linux system
C . data from a DVD copied using Windows system
D . data from a CD copied using Windows

View Answer

Answer: A

Explanation:

CDFS stands for Compact Disc File System, which is a file system used by Mac OS to store data on CDs. CDFS is also known as ISO 9660, which is a standard format for data interchange on optical discs. CDFS allows files to be accessed by different operating systems, such as Windows, Linux, and Mac OS. Therefore, an ISO file that is stored in CDFS format is data from a CD copied using Mac-based system.

Reference: = Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 4: Network Intrusion Analysis, Lesson 4.4: File Type Analysis, Topic 4.4.1: File Systems, page 4-40.