A Hard Drive Has Been Formatted as NTFS and Windows

question 12

Multiple Choice

A hard drive has been formatted as NTFS and Windows XP was installed. The user used fdisk to remove all partitions from that drive. Nothing else was done. You have imaged the drive and have opened the evidence file with EnCase. What would be the best way to examine this hard drive?

• A) Use the add Partition feature to rebuild the partition and then examine the system.
• B) EnCase will not see a drive that has been fdisked.
• C) Conduct a physical search of the hard drive and bookmark any evidence.
• D) Use the Recovered Deleted Partitions feature and then examine the system.

---

Definitions:

Significant Other

A person with whom someone has an important, intimate relationship that deeply influences their life.

Superego

The superego is a component of Sigmund Freud's psychoanalytic theory, representing the ethical and moral part of the psyche that internalizes societal and parental standards.

George Herbert Mead

An American sociologist and philosopher considered one of the founders of symbolic interactionism, focusing on how the self develops through social interaction.

Social Institutions

Established systems of societal organization that structure the activities of groups and individuals, such as family, education, religion, and government.