During a Linux forensic examination, the investigator needs to recover a deleted file that was stored in the /home partition. The file system is ext4. Which approach is most appropriate?

Create a forensic image of the partition and use `extundelete` on the image

Mount the partition read-only and use `grep` to search for file content

Run `fsck` on the partition to repair and recover the deleted file

Use the `file` command on the raw partition to identify the deleted file

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 2

Linux and Mac Forensics CHFI Practice Questions (Page 7)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

31questions here

7free pages

12concepts

Questions 31–31

31application · medium
During a Linux forensic examination, the investigator needs to recover a deleted file that was stored in the /home partition. The file system is ext4. Which approach is most appropriate?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Linux and Mac Forensics CHFI Practice Questions (Page 7)

Questions 31–31

During a Linux forensic examination, the investigator needs to recover a deleted file that was stored in the /home partition. The file system is ext4. Which approach is most appropriate?

Keep studying — Operating System Forensics