CompTIA Security+ (SY0-501) — Question 972

A forensic investigator has run into difficulty recovering usable files from a SAN drive. Which of the following SAN features might have caused the problem?

Answer options

• A. Storage multipaths
• B. Deduplication
• C. iSCSI initiator encryption
• D. Data snapshots

Correct answer: B

Explanation

Deduplication can create challenges for forensic investigators as it may eliminate duplicate data, making it harder to recover original files. The other options, such as storage multipaths, iSCSI initiator encryption, and data snapshots, do not inherently prevent file recovery in the same way that deduplication does.