Guidance_Software
GD0-100 · Question #24
GD0-100 Question #24: Real Exam Question with Answer & Explanation
The correct answer is B. Use the add Partition feature to rebuild the partition and then examine the system.. See the full explanation below for the reasoning.
Question
A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?
Options
- AConduct a physical search of the hard drive and bookmark any evidence.
- BUse the add Partition feature to rebuild the partition and then examine the system.
- CUse the recovered Deleted Partitions feature and then examine the system.
- DEnCase will not see a drive that has been fdisked.
Community Discussion
No community discussion yet for this question.