Exam 312-49v10 topic 1 question 237 discussion

The correct answer is D. It can find files hidden within ADS (Alternate Data Streams). Evidor is a digital forensics tool that can search for files and data on a Windows file system, including Alternate Data Streams (ADS), which are not indexed by the built-in Windows search. ADS allows files to contain hidden data streams, which can be used to conceal malicious files or data. While Windows search can find files based on their contents, it does not search ADS by default. Evidor, on the other hand, is designed to search for hidden data, including files hidden in ADS.

C < https://www.x-ways.net/evidor/

C: Cause you can find files hidden within ADS using the windows search as well, so the advantage is with Evidor you can check slack.

https://www.x-ways.net/evidor/: "Evidor allows to search text on hard disks and retrieves the context of keyword occurrences on computer media, not only by examining all files (the entire allocated space, even Windows swap/paging and hibernate files), but also currently unallocated space and so-called slack space."

It can find files hidden within ADS (Alternate Data Streams). ADS is a feature in the NTFS file system used in Windows that allows files to be hidden inside other files without changing the size or appearance of the host file. This can be used to hide malicious software, data or other files. Evidor is a tool used for digital forensics investigations, and it has the ability to search for files hidden within ADS, as well as to search for other types of hidden files, metadata, and other digital artifacts. In contrast, the built-in Windows search feature does not have the capability to search for files hidden within ADS, making Evidor a valuable tool in forensic investigations. Option A is incorrect because once a file is physically removed from the hard drive, it cannot be found by any search tool. Option B is incorrect because finding bad sectors on the hard drive is a function of disk repair tools and is not related to file search. Option C is also incorrect as searching slack space is a feature that is included in many file recovery tools, but not necessarily in Evidor.