Computer Hacking Forensic Investigator (CHFI v10) — Question 218

_____________ allows a forensic investigator to identify the missing links during investigation.

Answer options

• A. Chain of custody
• B. Exhibit numbering
• C. Evidence preservation
• D. Evidence reconstruction

Correct answer: D

Explanation

The correct answer is D, Evidence reconstruction, as it specifically involves piecing together missing elements in an investigation. Options A, B, and C focus on maintaining the integrity of evidence and tracking its handling, rather than directly addressing the identification of missing links.