According to theCHFI v11 Anti-Forensics TechniquesandDigital Evidence Analysisobjectives, attackers often attempt to evade detection bydeleting files, corrupting file system metadata, fragmenting data, or manipulating file extensions. When file system structures such as the MFT, FAT, or directory entries are missing or damaged, traditional file recovery methods fail. In such scenarios, investigators rely onfile carving.
File carvingis an advanced forensic technique that recovers files based onfile signatures (headers and footers)andcontent patterns, rather than file system metadata. CHFI v11 explains that file carving scansunallocated space, slack space, and raw disk sectorsto identify known byte patterns associated with specific file types (for example, JPEG headers FFD8FFE0 or PDF headers %PDF). This allows investigators to recover files even when filenames, extensions, and directory information have been intentionally altered or destroyed.
This technique is particularly effective againstanti-forensic tacticssuch as file extension mismatch and metadata wiping. While file carving may not always restore original filenames or timestamps, it is highly valuable for recovering theactual contentof hidden or deleted files. The other options are not aligned with CHFI methodology: rebuilding file systems from scratch is impractical, decryption addresses a different problem, and firmware-level access is not a standard forensic recovery method.
CHFI v11 explicitly highlightssignature-based and pattern-based carvingas the correct approach for recovering evidence from fragmented drives with missing metadata. Therefore, the correct answer isanalyzing file signatures and patterns in unallocated space, makingOption Dthe correct choice.
