GIAC Advanced Smartphone Forensics GASF Question # 2 Topic 1 Discussion

GIAC Advanced Smartphone Forensics GASF Question # 2 Topic 1 Discussion

GASF Exam Topic 1 Question 2 Discussion:
Question #: 2
Topic #: 1

Cellebrite’s Physical Analyzer will conduct a Quick Scan for images, which goes through and carves files that may have been deleted from the device. When carving for image files, which of the following methods is most effectively used to recover data?


A.

Update the signature database


B.

Carve based on file header


C.

Carve based on file metadata


D.

Carve based on memory ranges


Get Premium GASF Questions

Contribute your Thoughts:


Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.