Câu 117: 312-49V11: Computer Hacking Forensic Investigator

You are a forensic investigator who is analyzing a hard drive that was recently collected as evidence. You have been unsuccessful at locating any meaningful evidence within the file system and suspect a drive wiping utility may have been used. You have reviewed the keys within the software hive of the Windows registry and did not find any drive wiping utilities. How can you verify that drive wiping software was used on the hard drive?

1. A. Check the list of installed programs
2. B. Look for distinct repeating patterns on the hard drive at the bit level
3. C. Document in your report that you suspect a drive wiping utility was used, but no evidence was found — đáp án hiện tại
4. D. Load various drive wiping utilities offline, and export previous run reports