Question

which of the following are subfunctions associated with data extraction for digital forensics acquisition tools? (choose all that apply.)
□ a. tagging data of interest to the examination
□ b. copying fragmented data located in unallocated disk space
□ c. searching for specific data sets of interest
□ d. exploring and examining the contents of data sets of interest

Explanation:

Digital forensics acquisition tools' data extraction subfunctions focus on identifying, retrieving relevant data. Tagging marks data for later work, not extraction. Copying fragmented unallocated data is core extraction. Searching locates target data for extraction. Exploring/examining is post-extraction analysis, not extraction.

Answer:

b. Copying fragmented data located in unallocated disk space
c. Searching for specific data sets of interest