CompTIA CASP+ (CAS-004) — Question 562

A forensic investigator would use the foremost command for:

Answer options

• A. cloning disks.
• B. analyzing network-captured packets.
• C. recovering lost files.
• D. extracting features such as email addresses.

Correct answer: C

Explanation

The foremost command is specifically designed to recover lost files by carving data from disk images. Options A and B pertain to different types of tasks that are not relevant for foremost, while option D focuses on feature extraction rather than file recovery.