Exam CISSP Topic 4 Question 1104 Discussion

The best description of the purpose of software forensics is to determine the author and behavior of the code.
Software forensics is the application of forensic science to software, which involves the collection, analysis, and presentation of software-related evidence. Software forensics can be used for various purposes, such as investigating software crimes, disputes, or incidents, identifying software vulnerabilities or defects, verifying software compliance or quality, or recovering software data or functionality. However, the primary purpose of software forensics is to determine the author and behavior of the code, which can help to establish the origin, ownership, responsibility, or intention of the software. For example, software forensics can help to identify the creator, distributor, or user of a malware, a pirated software, or a stolen software. Software forensics can also help to understand the functionality, logic, or purpose of a software, such as what it does, how it works, or what it affects. To determine the author and behavior of the code, software forensics can use various techniques, such as code analysis, code comparison, code reverse engineering, code fingerprinting, or code attribution. To perform cyclic redundancy check (CRC) verification and detect changed applications, to review program code to determine the existence of backdoors, or to analyze possible malicious intent of malware are not the best descriptions of the purpose of software forensics. These are some of the possible applications or outcomes of software forensics, but they are not the main or overarching purpose of software forensics.
Moreover, these are not exclusive to software forensics, as they can also be performed by other software-related disciplines, such as software testing, software security, or software engineering.
References: Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 8, Software Development Security, page 855. CISSP All-in-One Exam Guide, Eighth Edition, Chapter 8, Software Development Security, page 794.