Disk forensics primarily involves which activities?

Disk forensics primarily involves which activities?

• A. Analyzing network traffic and transaction logs
• B. Acquiring and analyzing information stored on physical storage media, including recovered hidden or deleted data and identifying file authors
• C. Investigating email headers and routing
• D. Live memory analysis and volatile data capture

Answer: (B)

Disk forensics centers on acquiring and examining data stored on physical storage media, including recovering hidden or deleted data and identifying file authors. In practice, this means making a forensically sound copy of a drive, preserving integrity with hashes, and then inspecting the file system structures, metadata, and remnants left in unallocated space or slack space. You look for evidence embedded in file records, such as creation and modification times, authorship fields, and other properties, and you may carve or recover deleted files and fragments to reconstruct what happened on the device. This coverage is why it’s the best fit: it explicitly describes working with information stored on storage media and the kinds of recovered data and metadata that reveal who created or authored files, when they were created, and how they were used. The other options describe activities that belong to different branches of forensics—network forensic analysis focuses on traffic and logs, email forensics on headers and routing, and memory/volatility work on data held in RAM—areas that are not the primary focus of disk forensics.

Disk forensics centers on acquiring and examining data stored on physical storage media, including recovering hidden or deleted data and identifying file authors. In practice, this means making a forensically sound copy of a drive, preserving integrity with hashes, and then inspecting the file system structures, metadata, and remnants left in unallocated space or slack space. You look for evidence embedded in file records, such as creation and modification times, authorship fields, and other properties, and you may carve or recover deleted files and fragments to reconstruct what happened on the device.

This coverage is why it’s the best fit: it explicitly describes working with information stored on storage media and the kinds of recovered data and metadata that reveal who created or authored files, when they were created, and how they were used. The other options describe activities that belong to different branches of forensics—network forensic analysis focuses on traffic and logs, email forensics on headers and routing, and memory/volatility work on data held in RAM—areas that are not the primary focus of disk forensics.