A Hard Drive Has Been Formatted as NTFS and Windows

question 19

Multiple Choice

A hard drive has been formatted as NTFS and Windows XP was installed.  The user used fdisk to remove all partitions from that drive. Nothing else was done.  You have imaged the drive and have opened the evidence file with EnCase.  What would be the best way to examine this hard drive?

• A) EnCase will not see a drive that has been fdisked.
• B) Use the recovered Deleted Partitions feature and then examine the system.
• C) Conduct a physical search of the hard drive and bookmark any evidence.
• D) Use the add Partition feature to rebuild the partition and then examine the system.

---

Definitions:

Health Care Provider

A professional offering preventive, curative, promotional, or rehabilitative health care services in a systematic way to individuals, families, or communities.

Nonverbal Communication

The exchange of information between individuals through non-linguistic cues, including gestures, facial expressions, and body language.

Eye Contact

The act of looking directly into someone's eyes during communication, important for conveying trust, confidence, and engagement.

Politeness

The act of showing consideration for others through manners, respectful language, and behavior.