Multiple Choice
To undelete a file in the FAT file system, EnCase obtains the starting extent from the:
A) Directory entry
B) Operating system
C) File header
D) FAT
Correct Answer:

Verified
Correct Answer:
Verified
Related Questions
Q117: The following GREP expression was typed in
Q118: If a hash analysis is run on
Q119: What are the EnCase configuration .ini files
Q120: The EnCase methodology dictates that the lab
Q121: A SCSI drive is pinned as a
Q122: By default, what color does EnCase use
Q123: Search results are found in which of
Q124: The Windows 98 Start Menu has a
Q125: Creating an image of a hard drive
Q127: EnCase uses the _ to conduct a