EnCase can recover deleted files but does not have the capability of recovering deleted directories.
Correct Answer:
Verified
Q20: Log files are used by the forensic
Q21: The MD5 hashing algorithm is no longer
Q22: Just like Windows NT, Windows 98 has
Q23: NTFS time represents time as the number
Q24: In FAT32 file systems both the directory
Q26: "File carving" is an examination technique where
Q27: Windows evidentiary media must be acquired and
Q28: In the Windows environment, simply opening a
Q29: In NTFS, when a file is deleted
Q30: A forensic examiner would use logical access
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents