CompTIA Security+ (SY0-601) — Question 456
A security analyst discovers several jpg photos from a cellular phone during a forensics investigation involving a compromised system. The analyst runs a forensics tool to gather file metadata. Which of the following would be part of the images if all the metadata is still intact?
Answer options
- A. The GPS location
- B. When the file was deleted
- C. The total number of print jobs
- D. The number of copies made
Correct answer: A
Explanation
The correct answer is A, as jpg images can contain EXIF data which often includes GPS location information if location services were enabled on the device. The other options are incorrect because jpg files do not retain information about when they were deleted, the number of print jobs, or copies made, as this data is not standard metadata associated with image files.