Option B is the correct answer because CHFI v11 explicitly identifies program packers as an anti-forensics technique and separately lists program packers unpacking tools among the relevant forensic tools used to defeat or analyze such techniques.

Packers are commonly used to compress, obfuscate, or wrap malicious code so that its real contents are hidden from static inspection and some security tools. To investigate packed malware effectively, the examiner must reverse or remove that wrapper so the original executable code can be examined. That is exactly the role of unpacking tools . This aligns with CHFI’s focus on anti-forensics countermeasures and tools , and with malware-analysis objectives that require investigators to identify and extract malicious content before deeper examination.

The other options do not directly defeat the packing technique itself. Updating antivirus may improve detection in some cases, but it does not reveal the concealed code. Secure coding practices and vulnerability scanning are useful security measures, but they are not the forensic countermeasure for packed malware. Therefore, the most effective response is to use unpacking tools to expose the underlying program for analysis.