The Process of Retrieving Evidence from the Data of an Encrypted

question 30

Multiple Choice

The process of retrieving evidence from the data of an encrypted hard drive would be considered the job of which of the following?

• A) network forensics expert
• B) e-discovery expert
• C) ESI administrator
• D) device forensics expert

---

Definitions:

Functional Thinking

An approach focusing on understanding the purpose and practical applications of objects, ideas, or processes rather than their theoretical aspects.

Functional Fixedness

A block to problem solving that comes from thinking about objects in terms of only their typical functions.

Relative Comparison

Relative comparison involves assessing or measuring something in relation to another similar item, considering their similarities and differences.

Insight Behavior

The understanding or learning of things through psychological introspection or a sudden realization.