Which of the following are limitations to salvaging data through data carving?
A) File name and date-time stamps that were associated with the file are not salvaged.
B) The size of the original file may not be known, making it necessary to guess how much data to carve out.
C) Simple carving assumes all portions of the file were stored contiguously, and not fragmented.
D) All of the above.

Question

Quizplus · Accepted Answer

All of the choices listed are limitations associated with data carving. Data carving often cannot recover file metadata such as names and timestamps (A), may not accurately determine the original file size (B), and assumes files are stored in contiguous blocks, which is not always the case, especially with fragmented files (C).

Which of the Following Are Limitations to Salvaging Data Through