Computer Hacking Forensic Investigator (CHFI v10) — Question 287

Mark works for a government agency as a cyber-forensic investigator. He has been given the task of restoring data from a hard drive. The partition of the hard drive was deleted by a disgruntled employee in order to hide their nefarious actions. What tool should Mark use to restore the data?

Answer options

• A. R-Studio
• B. EFSDump
• C. Diskview
• D. Diskmon

Correct answer: A

Explanation

R-Studio is a powerful data recovery tool that can effectively restore lost partitions and recover deleted files, making it the right choice for Mark's task. EFSDump, Diskview, and Diskmon are not specifically designed for data recovery from deleted partitions, hence they are not suitable for this scenario.