A cyberanalyst has been tasked with recovering PDF files from a provided image file. Which of the following is the best file-carving tool for PDF recovery?

The correct answer is D. Foremost. Foremost is a dedicated file‑carving utility that scans raw disk images for known file headers and footers, such as PDF’s %PDF- and %%EOF, and extracts intact documents without relying on filesystem metadata. This makes it the go-to tool for recovering PDFs from a forensic image.

Submitted by devops_kid· Mar 6, 2026Security Operations

Question

Options

Aobjdump
BStrings
Cdd
DForemost

How the community answered

(34 responses)

A
3% (1)
B
6% (2)
D
91% (31)

Explanation

Foremost is a dedicated file‑carving utility that scans raw disk images for known file headers and footers, such as PDF’s %PDF- and %%EOF, and extracts intact documents without relying on filesystem metadata. This makes it the go-to tool for recovering PDFs from a forensic image.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice