An analyst received a forensically sound copy of an employeeâ’s hard drive. The employeeâ’s manager suspects inappropriate images may have been deleted from the hard drive. Which of the following could help the analyst recover the deleted evidence?
A. File hashing utility
B. File timestamps
C. File carving tool
D. File analysis tool