CompTIA CySA+ (CS0-002) — Question 397

After examining a header and footer file, a security analyst begins reconstructing files by scanning the raw data bytes of a hard disk and rebuilding them. Which of the following techniques is the analyst using?

Answer options

• A. Header analysis
• B. File carving
• C. Metadata analysis
• D. Data recovery

Correct answer: B

Explanation

The correct answer is B, File carving, which involves extracting files from raw data based on their headers and footers. Header analysis (A) focuses on examining the information within a file's header, while metadata analysis (C) deals with the file's attributes rather than its content. Data recovery (D) generally refers to restoring lost data, which is broader and may not specifically involve reconstructing files from raw data.