Which statement is accurate regarding a disk editor's capabilities for forensic testing?

• A. A disk editor provides flexibility in testing but might not be capable of examining the contents of compressed files.
• B. A disk editor can always examine contents of compressed files.
• C. A disk editor is rarely used for testing.
• D. A disk editor cannot edit data in a disk image.

Answer: (A)

Disk editors give you low-level access to a disk image, allowing you to view and modify specific sectors or bytes. This flexibility is what makes them useful for forensic testing: you can inspect how data is stored, reconstruct artifacts, or test how changes would affect a filesystem or layout. But data within a disk image is stored as raw bytes. If a file is compressed, the disk image contains the compressed bytes, not the uncompressed content, and the editor won’t automatically decode or interpret that content. To actually read the decompressed data, you’d need to extract and decompress it with the appropriate tools. So this combination—open, flexible testing with raw data, plus a limitation around automatically examining compressed contents—best matches this statement.

The other options aren’t as accurate: you don’t always get to examine compressed contents without additional steps, so it isn’t guaranteed; disk editors are not rarely used in testing, they’re a common tool; and disk editors can edit data in a disk image by altering the raw bytes, so that claim isn’t correct either.