Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?
A) 5,9,11
B) 5,6,7
C) 7,8,9
D) 6,7,8
Correct Answer:
Verified
Q84: Search terms are stored in what .ini
Q85: Within EnCase, what is the purpose of
Q86: What information should be obtained from the
Q87: A hash library would most accurately be
Q88: The end of a logical file to
Q90: How many copies of the FAT are
Q91: Within EnCase for Windows, the search process
Q92: GREP terms are automatically recognized as GREP
Q93: You are working in a computer forensic
Q94: In DOS acquisition mode, if a physical
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents