Which task is described as recovering information hidden or deleted to hide evidence?

• A. Data recovery
• B. Data deletion
• C. Data carving
• D. Forensic imaging

Answer: (A)

Recovering information hidden or deleted to hide evidence is data recovery. This task focuses on retrieving data that has been erased, concealed, or made inaccessible, so investigators can uncover what happened and preserve evidence. In a forensic context, this often means examining unallocated space, slack space, and fragmented remnants to reconstruct files or artifacts that the user attempted to remove or hide. The other options describe different things: deleting data is the act of removing it, data carving is a specialized technique to rebuild files from raw data when metadata is missing, and forensic imaging is about making an exact copy of a drive for analysis rather than directly recovering data.