During a forensic investigation into a suspected data breach, the investigator discovers that the attacker...

This scenario aligns with CHFI v11 objectives under Anti-Forensics Techniques , specifically data destruction and data wiping methods . The key indicator in the question is that all addressable locations on the storage device have been replaced with arbitrary characters , rendering the original data permanently unrecoverable—even using advanced forensic tools. CHFI v11 explains that this outcome is characteristic of intentional data overwriting , where original data is substituted with meaningless or random values to destroy evidentiary content.

This technique is commonly referred to as data wiping or data substitution , an anti-forensic method designed to defeat file recovery, carving, and residual data analysis. By overwriting every sector of the disk with irrelevant data patterns, the attacker ensures that neither file system metadata nor raw disk analysis can reconstruct the original files.

Encryption (Option A) preserves data but makes it unreadable, not destroyed. Magnetic degaussing (Option B) affects magnetic media but does not result in structured arbitrary characters across all addressable locations as described. Physical destruction (Option C) would damage hardware rather than systematically overwrite data. Therefore, consistent with CHFI v11 classifications, the attacker employed data substitution through overwriting , making Option D the correct answer.