You suspect that there are a number of deleted files that can still be salvaged in the unallocated space of a drive image. During which phase of the investigation would you use a data carving utility?
a. Examination
b. Acquisition
c. Identification/Assessment
d. Analysis
e. Reporting
a. Examination
Computer Science & Information Technology
You might also like to view...
In OpenOffice Base, the box that displays all of the fields in a table or query upon which another object is based is called the field ________
Fill in the blank(s) with correct word
Computer Science & Information Technology
Which of the following statements is false?
a. Variables declared in the body of a particular method are local variables and can be used only in that method. b. A method’s parameters are local variables of the method. c. Every method’s body is delimited by left and right braces ({ and }). d. Keyword null indicates that a method will perform a task but will not return any information.
Computer Science & Information Technology