A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?
A) EnCase will not see a drive that has been fdisked.
B) Use the recovered Deleted Partitions feature and then examine the system.
C) Conduct a physical search of the hard drive and bookmark any evidence.
D) Use the add Partition feature to rebuild the partition and then examine the system.
Correct Answer:
Verified
Q7: What are the EnCase configuration .ini files
Q8: Which of the following would be a
Q9: A FAT directory has as a logical
Q10: In Windows, the file MyNote.txt is deleted
Q11: Which of the following selections would be
Q13: Within EnCase for Windows, the search process
Q14: Hash libraries are commonly used to:
A) Compare
Q15: RAM is an acronym for:
A) Random Addressable
Q16: In hexadecimal notation, one byte is represented
Q17: In DOS and Windows, how many bytes
Unlock this Answer For Free Now!
View this answer and more for free by performing one of the following actions
Scan the QR code to install the App and get 2 free unlocks
Unlock quizzes for free by uploading documents