What does mactime, an essential part of the coroner's toolkit do?
A) It traverses the file system and produces a listing of all files based on the modification, access and change timestamps
B) It can recover deleted file space and search it for data. However, it does not allow the investigator to preview them
C) The tools scans for i-node information, which is used by other tools in the tool kit
D) It is too specific to the MAC OS and forms a core component of the toolkit
Correct Answer:
Verified
Q479: Bob has been trying to penetrate a
Q480: Under which Federal Statutes does FBI investigate
Q481: What should you do when approached by
Q482: You are called in to assist the
Q483: What information do you need to recover
Q485: Chris has been called upon to investigate
Q486: Volatile Memory is one of the leading
Q487: One way to identify the presence of
Q488: Which of the following refers to the
Q489: An Employee is suspected of stealing proprietary
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents