Sort:  

It depends on the task. There are soooo many utilities to recover files. Part of the CHFI exam is FTK and EnCase work, but I still do not have much experience using them.