GIAC Certified Forensic Analyst (GCFA) — Question 22

Which of the following tools is used to restore deleted files from Linux and Mac OS X file system?

Answer options

• A. Easy-Undelete
• B. Active@ UNERASER
• C. Active@ UNDELETE
• D. R-Undelete

Correct answer: A

Explanation

The correct answer is A, Easy-Undelete, as it is specifically designed to recover deleted files from various file systems including those used by Linux and Mac OS X. The other options either do not support these operating systems or are not intended for file recovery in this context.