You are a forensic analyst working on a case of a possible cyber-attack on a...

Option B. Keyword search is the best answer because the problem is the large volume of data and the need to expedite analysis . In CHFI v11, investigators are expected to use forensic tools efficiently to narrow evidence and find relevant artifacts quickly rather than reviewing everything manually. Keyword search is one of the most direct ways to locate names, account identifiers, project terms, malicious filenames, URLs, commands, or other case-relevant strings across a large disk image.

File carving helps recover deleted files, timeline analysis helps reconstruct activity order, and image mounting simply makes the image accessible. None of those is as immediately useful as keyword searching when the main challenge is reducing the workload of manual review in a huge dataset.

Because the question emphasizes speed and efficiency in analyzing a large image with Autopsy, the feature that most directly supports that goal is keyword search . It allows the examiner to focus quickly on relevant evidence and is consistent with CHFI’s broader approach to efficient digital evidence analysis.