A technician is trying to recover information on a computer that has been hidden or deleted on purpose in order to hide evidence of a crime. Which type of task is the technician performing?

• A. Data deletion
• B. Data recovery
• C. Forensic imaging
• D. Data carving

Answer: (B)

Recovering information that someone has deleted or hidden is data recovery. When a file is deleted, its data often remains on the drive in unallocated space or within hidden areas, and investigators use tools to locate those remnants and reconstruct the original data so evidence can be analyzed. Forensic imaging is about making an exact copy of the drive to preserve evidence, not the act of retrieving deleted data. Data carving is a more specific technique used during recovery to reconstruct files based on data signatures when metadata is missing; the scenario describes the overall task of recovering the information, which is data recovery.