Computer Hacking Forensic Investigator (CHFI v10) — Question 130

What advantage does the tool Evidor have over the built-in Windows search?

Answer options

• A. It can find deleted files even after they have been physically removed
• B. It can find bad sectors on the hard drive
• C. It can search slack space
• D. It can find files hidden within ADS

Correct answer: C

Explanation

The correct answer is C because Evidor is specifically designed to search slack space, which is not accessible through the standard Windows search. Options A and D are incorrect since while they involve file recovery and hidden data, they do not specifically refer to slack space, which is the unique advantage of Evidor. Option B is also incorrect as it pertains to hard drive condition rather than file search capabilities.