Exam 312-49v10 topic 1 question 714 discussion

the investigator’s first approach should be to mount compound files.

Program packers are used by attackers to hide their data. In this regard, the technique is similar to cryptography. The packers compress the files using various algorithms. Hence, unless the investigators know the tool that has been used to pack the file and have a tool to unpack it, they will not be able to access it. Using this technique, the attacker can hide the evidence files into containers, thereby making them hard to detect. Therefore, during forensic investigations, the investigator’s first approach should be to mount compound files. Program packers that are password-protected can pose a challenge during investigation as investigators need to first decrypt the password to unpack the file.