?Describe two methods for filtering data- separating good data from suspicious data.

What will be an ideal response?

?To filter data, you can use hash values to create a known good hash value list of a fresh installation of an OS, all applications, and known good images and documents (spreadsheets, test files, and so on). With this information, an investigator could ignore all files on this known good list and focus on other files that aren't on this list.Another way to filter data is analyzing and verifying header values for known file types. Each file type has a header value associated with a file extension, and many forensic tools include a list of common file headers. To view these file headers, you use a hexadecimal editor, which can tell you whether a file extension is incorrect for the file type.