The strings utility extracts human-readable text from binary files. Security analysts use it to identify Indicators of Compromise (IoCs) such as URLs, IP addresses, filenames, and commands embedded in the malware.
Option A (reconstructing timeline) would require event logs or forensic timeline tools.
Option C (replicating the attack) involves execution in a sandbox, not static string extraction.