Skip to content

CS Professional · Internal and Forensic Audit · Cyber Forensics

A forensic auditor is asked to recover evidence of a deleted spreadsheet from a company's USB drive. Which statement about the tools and technique is correct?

The correct approach is to connect the drive through a write blocker and attempt recovery or file carving. Deleted data often remains until overwritten, and the write blocker ensures the original media is not modified. Normal mounting or reformatting risks altering or destroying evidence.

  1. ADeleted files are always overwritten at once, so recovery by file carving is impossible
  2. BUsing a write blocker lets the examiner read the drive and attempt carving of deleted files without modifying itCorrect
  3. CMounting the drive normally on the examiner's PC is preferred as it is faster
  4. DRecovery is possible only after reformatting the drive

Explanation

Deleting usually removes only the file system pointers, so the data may remain until overwritten and can be recovered by carving or undelete tools. A write blocker prevents any writes to the source during examination. Normal mounting may alter timestamps and data, and reformatting would destroy evidence.

Did you get it right without looking?

One question tells you little. A timed set on Cyber Forensics shows your real accuracy, how long you take and where you lose marks.

Practise Cyber ForensicsFree diagnostic mock

More Cyber Forensics questions