In general, which field involves investigating data retrieved from hard disks by applying scientific methods?

• A. Disaster Recovery
• B. Data Recovery
• C. Network Forensics
• D. Computer Forensics

Answer: (D)

Investigating data retrieved from hard disks by applying scientific methods is computer forensics. In this field, investigators create a precise bit-for-bit image of the drive, verify integrity with hash values, preserve chain of custody, and analyze artifacts to reconstruct activity and timelines while ensuring the evidence remains admissible. This is distinct from data recovery, which aims to restore inaccessible data without an emphasis on evidentiary integrity; disaster recovery, which centers on restoring IT services after a disruption; and network forensics, which analyzes network traffic and logs rather than the contents of a single hard disk.