It May Not Be Possible to Recover the File Names

Multiple Choice

It may not be possible to recover the file names and date-time stamps from an HFS volume with forensic tools because:

A) That information is overwritten when a file is deleted.
B) The inode table is deleted.
C) That information is only held in memory.
D) The B-tree data structure frequently rebalances.