Computer Hacking Forensic Investigator (CHFI v10) — Question 270

A forensic examiner encounters a computer with a failed OS installation and the master boot record (MBR) or partition sector damaged. Which of the following tools can find and restore files and information in the disk?

Answer options

Correct answer: C

Explanation

The correct answer is R-Studio, which is specifically designed for data recovery and can handle situations with damaged partitions or boot records. NetCat is primarily used for network communication, Helix is a forensic toolkit but not specifically for file recovery, and Wireshark is a network protocol analyzer, making them unsuitable for this task.