Discussion
When performing file carving during digital forensic analysis, recovering a JPEG file from unallocated disk space primarily relies on which of the following ?
Answer: D
File carving relies on header-footer signatures.
Carving recovers files from raw disk data without any file-system record. The tool scans unallocated space for the byte pattern that begins a file type and the pattern that ends it, and extracts everything between. A JPEG begins with FF D8 FF and ends with FF D9, so those signatures mark where each image starts and stops.
Registry keys record Windows configuration and user activity, not file contents. An MFT timestamp belongs to a file-system record, which is exactly what carving does without. TRIM commands work against recovery: they let an SSD wipe freed blocks.
Post your comment
Please log in or register to post a comment.
Examination Categories
- SSC Exams
- Banking Exams
- Teaching Exams
- Civil Services Exams
- Railways Exams
- Engineering Recruitment Exams
- Defence Exams
- State Government Exams
- Police Exams
- Insurance Exams
- Nursing Exams
- Other Government Exams
- NRA CET
- PG Entrance Exams
- Campus Placement
- MBA Entrance Exams
- CUET and UG Entrance
- Judiciary Exams
- Regulatory Body Exams
- Software Development