CompTIACompTIA
CS0-003 · Question #87
CS0-003 Question #87: Real Exam Question with Answer & Explanation
The correct answer is B: File carving. The analyst is performing file carving, a digital forensics technique to reconstruct files from raw data by recognizing file headers and footers.
Submitted by joshua94· Mar 6, 2026Incident Response and Management
Question
After examining a header and footer file, a security analyst begins reconstructing files by scanning the raw data bytes of a hard disk and rebuilding them. Which of the following techniques is the analyst using?
Options
- AHeader analysis
- BFile carving
- CMetadata analysis
- DData recovery
Explanation
The analyst is performing file carving, a digital forensics technique to reconstruct files from raw data by recognizing file headers and footers.
Common mistakes.
- A. Header analysis is a component of file carving, involving the identification of the start of a file, but it does not encompass the entire process of scanning raw data and rebuilding the complete file.
- C. Metadata analysis involves examining information about files, such as creation dates, modification times, and permissions, rather than reconstructing the actual file content from raw data bytes.
- D. Data recovery is a broader term that encompasses various methods to restore lost or corrupted data, while file carving is a specific technique within data recovery that focuses on reconstructing files from raw data using header and footer recognition.
Concept tested. Digital forensics - file carving
Topics
#File carving#Digital forensics#Data recovery#Incident analysis
Community Discussion
No community discussion yet for this question.