Please answer the following questions
In computer forensics, in order to show a file is original, once we get the artefact, we may use the hash function to get a digest (.e. the hash value of the given file). Here, we have a statement: "later, in order to show that the file has not been modified, we can decrypt the digest and obtain the original file based on this digest." The statement is (True or False) True False
Once the TCP 3-way handshake has been completed, the state of the corresponding port becomes close-wait time-wait O closed listening established
Computer forensics involves all of the following stated activities except:
Extraction of computer data.
Preservation of computer data.
Interpretation of computer data.
Manipulation and modification of computer data.
Which of the following tools can be used to display a list of all the files that are open on a computer that are being accessed from a remote system?