GIAC
GCFE · Question #146
GCFE Question #146: Real Exam Question with Answer & Explanation
The correct answer is A. To recover remnants of deleted files or data left from file resizing. See the full explanation below for the reasoning.
Question
How do forensic analysts use slack space in the context of digital investigations?
Options
- ATo recover remnants of deleted files or data left from file resizing
- BTo monitor changes in network configurations
- CTo log user interaction with applications
- DTo track the installation of new hardware
Community Discussion
No community discussion yet for this question.