QUESTION 3 In NTFS, a deleted compressed file is hard to recover because it is e

Question

QUESTION 3 In NTFS, a deleted compressed file is hard to recover because it is encrypted. it uses multiple sectors. it requires Microsoft's secret compression algorithm it may be using multiple compression algorithms QUESTION 4 In a FAT system, the unallocated clusters from the point of view of forensics do not exist. O exist but have all zeros in them. retain data from previous allocations and are very useful therefore. retain data from previous allocations, are useless therefore QUESTION 5 The main purpose of volatility framework is 0 to analyze hard disks. to acquire memory data for forensics. to provide test data for analysis. to analyze memory data acquired using another tool.

Explanation / Answer

Hi please find the answer.

=====================================================

Question -3

Answer - 4

Because the data are compressed by compression algorithm when we compress the data they use compression algorithm to compressed the file

===================================

Question-4

Answer- 3

The unallocated clusters. form the point of view  forensic data recovery is that w hen a file on a hard drive containing data is deleted, the data belonging to the file remains on the disk this area is known as unallocated clusters. The data will remain there until it is overwritten by another file any data found in this area at one time belonged to a file which has since been deleted

================================================

Question - 5

Answer - 2

The main purpose of volatility framework is to aquire memory data for forensics

=========================================================

If you have any query please let me know first by comment i will give solutions

Related Questions

Navigate

• Browse (All)
• Browse Q
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.