According to theCHFI v11 Computer Forensics Fundamentals, one of the primary objectives of computer forensics is toidentify, preserve, analyze, and present digital evidence, even when adversaries deliberately attempt to conceal or destroy it. In cybercrime cases involving data theft, attackers often employanti-forensics techniquessuch as file deletion, log wiping, data overwriting, encryption, and artifact obfuscation to evade detection and attribution.

The ability torecover deleted files and hidden datais therefore critical. CHFI v11 emphasizes that deleted data is rarely immediately destroyed; instead, file system pointers are removed while the underlying data may still exist in unallocated space, slack space, or backup structures. Forensic techniques such asfile carving, analysis ofunallocated disk space, examination ofshadow copies, and recovery ofhidden or encrypted containersallow investigators to reconstruct attacker activity and uncover intent, timelines, and methods used during the breach.

Other options listed are not objectives of computer forensics as defined by CHFI. Weather analysis, market forecasting, and physical security assessments fall outside the scope of digital forensic investigations. CHFI v11 explicitly identifiesdata recovery and reconstruction of erased digital footprintsas essential for establishing accountability and ensuring evidence admissibility in legal proceedings.

Therefore, to effectively identify and prosecute perpetrators who attempted to erase evidence, investigators must focus onrecovering deleted files and hidden data, makingOption Dthe correct and CHFI-verified answer.