Multiple Choice
To undelete a file in the FAT file system, EnCase obtains the starting extent from the:
A) Directory entry
B) FAT
C) Operating system
D) File header
Correct Answer:

Verified
Correct Answer:
Verified
Related Questions
Q71: Using good forensic practices, when seizing a
Q72: Which of the following is commonly used
Q73: A restored floppy diskette will have the
Q74: The case file should be archived with
Q75: A case file can contain _ hard
Q77: Which of the following aspects of the
Q78: EnCase marks a file as overwritten when
Q79: Creating an image of a hard drive
Q80: The EnCase case file can be best
Q81: Will EnCase allow a user to write