GIAC
GCFE · Question #90
Why is it important for forensic analysts to understand the concept of 'file carving' in the recovery of digital evidence?
The correct answer is A. It is used to reconstruct files from unallocated space without relying on metadata. See the full explanation below for the reasoning.
Question
Why is it important for forensic analysts to understand the concept of 'file carving' in the recovery of digital evidence?
Options
- AIt is used to reconstruct files from unallocated space without relying on metadata.
- BIt helps in configuring network settings for secure data transmission.
- CIt involves updating system software to retrieve lost data.
- DIt tracks the installation and usage of mobile apps.
How the community answered
(24 responses)- A79% (19)
- B4% (1)
- C4% (1)
- D13% (3)
Community Discussion
No community discussion yet for this question.