You suspect that there are a number of deleted files that can still be salvaged in the unallocated space of a drive image. During which phase of the investigation would you use a data carving utility?

a. Examination
b. Acquisition
c. Identification/Assessment
d. Analysis
e. Reporting

a. Examination

Computer Science & Information Technology

You might also like to view...

In OpenOffice Base, the box that displays all of the fields in a table or query upon which another object is based is called the field ________

Fill in the blank(s) with correct word

Computer Science & Information Technology

Which of the following statements is false?

a. Variables declared in the body of a particular method are local variables and can be used only in that method. b. A method’s parameters are local variables of the method. c. Every method’s body is delimited by left and right braces ({ and }). d. Keyword null indicates that a method will perform a task but will not return any information.

Computer Science & Information Technology