Question

what is the purpose of the reconstruction function of a digital forensics tool?
○ a. the reconstruction function in a digital forensics program will extract additional evidence from a suspects disk image.
○ b. the reconstruction function only rebuilds data carved from a disk image file.
○ c. the reconstruction function is a copy of a logical partition to another logical partition.
○ d. the reconstruction function duplicates a suspects drive.

Explanation:

Digital forensics reconstruction focuses on rebuilding fragmented or carved data from disk images to recover usable information. Option a describes extraction, not reconstruction. Option c refers to partition cloning, and option d is drive duplication, which are not the purpose of reconstruction. Only option b accurately states the core purpose of the reconstruction function.

Answer:

b. The reconstruction function only rebuilds data carved from a disk image file.