QUESTION $2$: $(20$ MARKS$)$

$($a$)$ Different tools are used by forensics agencies. One very common tool is The

Sleuth Kit $($TSK$).$ What are the main features of TSK$?(6$ Marks$)$

$($b$)$ Distinguish between white hat and black hat hackers? $(4$ Marks$)$

$($c$)$ If ever you are required to recover files containing mathematical codes in a

confidential case, explain in detail how you will proceed by using Linux based

forensics tools. Assume that the seized HDD is made available to you?

Your answer should clearly indicate all the steps to ensure forensic

soundness. $(10$ marks$)$