Discussion
SD forensics is generally more challenging than HDD forensics primarily due to which of the following factors ?
Answer: A
The main factor is TRIM operations and wear-leveling.
The question's 'SD' is flash storage (solid-state drives, and in the same way SD cards), which behaves very differently from a magnetic hard disk. On an HDD, a deleted file stays in place until overwritten, so it can be recovered. On flash, the TRIM command tells the drive which blocks are no longer in use, and the drive's own garbage collection erases them, often within moments and even while the device is write-blocked. Wear-leveling constantly remaps logical blocks to different physical cells, so data moves and old copies sit in areas the examiner cannot address.
Storage size is not inherently larger on flash, flash drives use MBR or GPT partition tables like hard disks, and encryption is optional, not always present.
Post your comment
Please log in or register to post a comment.
Examination Categories
- SSC Exams
- Banking Exams
- Teaching Exams
- Civil Services Exams
- Railways Exams
- Engineering Recruitment Exams
- Defence Exams
- State Government Exams
- Police Exams
- Insurance Exams
- Nursing Exams
- Other Government Exams
- NRA CET
- PG Entrance Exams
- Campus Placement
- MBA Entrance Exams
- CUET and UG Entrance
- Judiciary Exams
- Regulatory Body Exams
- Software Development