Final answer:
Evidor is a digital forensic tool that searches and retrieves the context of keyword occurrences within the entire allocated space of a hard drive, including local and potentially remote hard disks, making Options 1 and 2 correct.
Step-by-step explanation:
The question pertains to Evidor, which is a tool used for searching text on computer media, especially within the context of digital forensics. The true statements about Evidor are as follows:
- Option 1: Evidor can indeed search text on hard disks and retrieves the context of keyword occurrences on computer media. It's specifically designed to search through various types of files and provide the context in which specific keywords are found.
- Option 2: One of the features of Evidor is examining the entire allocated space on a hard drive, which includes swap space, hibernate files, and even unallocated space, giving forensic examiners a comprehensive set of data for analysis.
- While the question does not directly provide information about Evidor's capability with local and remote hard disks, it is common for forensic tools to have the functionality to work with both local and networked (remote) storage devices for in-depth scrutiny and examination.
Therefore, Options 1 and 2 are correct regarding the capabilities of Evidor. If by Option 3 the implication is that Evidor can analyze both local and remote hard disks, then this option would also be correct.