⚠️ Retired / Legacy Exam: This exam has been retired or replaced. These practice questions are kept for reference only. Please check the official vendor website for current exam versions before studying.
An analyst received a forensically sound copy of an employeeâ’s hard drive. The employeeâ’s manager suspects inappropriate images may have been deleted from the hard drive. Which of the following could help the analyst recover the deleted evidence?
A. File hashing utility
B. File timestamps
C. File carving tool
D. File analysis tool