Identifying File Creator and Creation Date

Digital Forensics and Incident Response

A security analyst locates a potentially malicious video file on a server and needs to identify both the creation date and the file's creator. Which of the following actions would most likely give the security analyst the information required?

  1. Obtain the file's SHA-256 hash.
  2. Use hexdump on the file's contents.
  3. Check endpoint logs.
  4. Query the file's metadata. Source Reference Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests knowledge of digital forensics basics, specifically distinguishing between content analysis and attribute inspection, while avoiding the trap of confusing hash values with descriptive data.

Querying file metadata is the primary method for retrieving creation dates and author information. Community consensus confirms that metadata provides direct descriptive data about a file's origin.

Community Discussion (3 comments)

geocis 👍 6
Answer D......Metadata is data that describes other data, such as its format, origin, creation date, author, and other attributes. Video files, like other types of files, can contain metadata that can provide useful information for forensic analysis.
Shaman73 👍 5
D. Query the file's metadata.
dbrowndiver 👍 3 Selected: D
In this scenario, choice "D" is correct. Query the file's metadata is the correct answer because metadata provides direct information about the file's creation date and possibly the creator. This method is the most efficient and effective way to gather the required details about a potentially malicious video file. By querying the file's metadata, the security analyst can access information about when the file was created and potentially who created it, assuming the creator's details were embedded or tagged during the file's creation.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Querying the file's metadata (Option D) is the correct action because metadata contains specific attributes such as creation date, modification date, and author/creator information. For video files, this often includes EXIF or similar tags embedded by the recording software or device.

Why the Other Options Are Wrong

SHA-256 hashes (Option A) provide a unique fingerprint for integrity verification but contain no human-readable details about the file's history. Hexdump (Option B) displays raw binary data; while some metadata might be visible in plaintext within the hex stream, it is not the most efficient or reliable method for extracting structured creator info. Endpoint logs (Option C) track system events like file access or creation times but typically do not store the original file creator identity unless specific auditing policies were already in place.

Community Comment Notes

Comment [1] correctly defines metadata as 'data that describes other data,' highlighting its role in forensic analysis. Comment [2] emphasizes efficiency, noting that querying metadata is the most direct way to gather required details without parsing raw content.

Related Analysis

An auditor discovered multiple insecure ports on some server

A-Grade

A security team is setting up a new environment for hosting

S-Grade

Which of the following is the best way to consistently deter

S-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide