EC-Council 112-57 Exam - Topic 5 Question 19 Discussion

The scenario describes the use of BitLocker to lock an entire disk volume with a secret key, preventing access to the contents. In digital forensics, this is a classic example of encryption as an anti-forensics technique. Full-disk or full-volume encryption transforms readable data into ciphertext using cryptographic algorithms so that, without the correct key (password, recovery key, TPM-bound protector, etc.), the data is computationally infeasible to interpret. This directly obstructs evidence acquisition and analysis because a forensic image of the drive will largely contain encrypted blocks rather than interpretable file system structures and user data.

This differs from the other options: file carving is a forensic recovery method (often used by investigators) that reconstructs files from unallocated space; it is not an anti-forensics method used to block access. Artifact wiping attempts to erase traces by deleting or overwriting files, logs, or free space, but it does not inherently prevent access to remaining data if wiping is incomplete. Trail obfuscation involves misleading or altering logs and traces to confuse investigators, whereas encryption primarily denies content visibility by design. Because BitLocker is explicitly a volume encryption mechanism used here to deny access, the correct anti-forensic technique is Encryption (D).