312-49 Question #20: Real Exam Question with Answer & Explanation

The correct answer is A: True. This statement is True. In digital forensics, deleted partition recovery is a defined investigative process in which the examiner analyzes the partition table, master boot record (MBR) or GUID Partition Table (GPT), and unallocated disk space to locate, evaluate, and reconstruct

Submitted by mike_84· Apr 18, 2026Disk Forensics

Question

Recovery of the deleted partition is the process by which the investigator evaluates and extracts the deleted partitions.

Options

ATrue
BFalse

Explanation

This statement is True. In digital forensics, deleted partition recovery is a defined investigative process in which the examiner analyzes the partition table, master boot record (MBR) or GUID Partition Table (GPT), and unallocated disk space to locate, evaluate, and reconstruct partitions that have been deleted. Forensic tools such as TestDisk, EnCase, and FTK support this process. Since deleting a partition typically only removes the partition table entry rather than the actual data, the underlying data often remains intact and recoverable.

Topics

#Partition recovery#Deleted data#Disk analysis#Data extraction

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice Browse All 312-49 Questions