In the aftermath of a sophisticated cyber-attack on a financial institution, forensic investigators are tasked...

Option B is the most effective answer because CHFI v11 specifically lists password protection and encryption as anti-forensic techniques and also includes anti-forensics countermeasures and tools . In addition, the blueprint references password cracking tools and using rainbow tables to crack hashed passwords , which indicates that CHFI expects investigators to understand the difference between cracking passwords, handling encryption, and choosing efficient methods.

A dictionary attack is generally more practical and efficient than a full brute-force approach when investigators suspect human-created passwords. It tests likely password candidates first, often producing results faster and with fewer resources. A brute-force attack may eventually work, but it is usually slower and less efficient as an initial strategy. Rainbow tables are mainly useful against certain hashed password scenarios, not directly for decrypting arbitrary password-protected files or directories. Phishing is not an acceptable forensic response and would be unlawful and unethical.

Since the question asks for the most effective strategy to counter password-based anti-forensics in a professional investigation, the best CHFI-aligned answer is to begin with a dictionary attack using appropriate forensic tools and procedures.