Question

the reconstruction function of a forensics tool can be used for which of the following? (choose all that apply.)
□ a. re - create a suspect drive to show what happened.
□ b. create a copy of a drive for other investigators.
□ c. recover file headers.
□ d. re - create a drive compromised by malware.

Explanation:

• Option a: Forensic reconstruction can replicate a suspect drive to analyze events.
• Option b: Creating a drive copy is imaging, not reconstruction.
• Option c: Reconstruction recovers/repairs file headers to restore files.
• Option d: Reconstruction can restore a malware-compromised drive to its prior state.

Answer:

a. Re-create a suspect drive to show what happened.
c. Recover file headers.
d. Re-create a drive compromised by malware.