Most forensic software applications will perform an indexing ...

[jwb375]

Most forensic software applications will perform an indexing process on a suspect hard drive or data source. What benefits are there to this indexing?
 
  What will be an ideal response?

Question 2

Which of the following are the two correct types of IP address discussed?
 
  a. Transfer IP and Stationary IP
  b. Motive IP and Permanent IP
  c. Static IP and Redundant IP
  d. Static IP and Dynamic IP

[prumorgan]

Answer to Question 1

The indexing process performs a number of functions on every file or file fragment. One thing it does is index every character, letter, and number of every file. In the case of text or word processing documents, this means that it indexes every word in every file. This allows the investigator to perform a very exacting word or phrase search on the entire drive. Because the material is indexed during this phase and not when the search is initiated, the investigator will get those search results very quickly. The indexing also checks all file headers so that files can be grouped by file type.

Once the drive image has been completely indexed, the software can easily report on a wide variety of factors. It can tell the specialist how many files are on the drive, what their sizes and locations are, and whether or not they have been deleted.

Answer to Question 2

D