A forensic examiner needs to acquire data from a Mac with an APFS volume that has multiple snapshots. The examiner wants to preserve the state of the file system at a specific point in time. Which acquisition method is most appropriate?

Use the 'tmutil' command to create a new snapshot and then image the snapshot.

Use a forensic tool that supports APFS snapshots and image the specific snapshot.

Perform a live acquisition of the mounted volume using a forensic tool.

Boot into Recovery Mode and use 'asr' to image the APFS volume.

A Linux administrator is investigating a server that was compromised. The attacker deleted several log files from /var/log. The root filesystem is ext4. Which method is most likely to recover the deleted log files?

Use a file recovery tool that scans the raw disk for file signatures and attempts to reconstruct the files.

Use the systemd journal to retrieve the log entries that were written before deletion.

Use the ext4 journal to replay the transactions and restore the deleted files.

Use the ext4 orphan list to recover the deleted inodes.

EC-CouncilDigital Forensics Essentials

Domain 2Objective 2

Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 1)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

38questions here

8free pages

7concepts

Questions 1–5

1foundation · easy
On a Mac with an Intel processor, which firmware type is used during the boot process?
Select an answer first
2expert · hard
A forensic examiner needs to acquire data from a Mac with an APFS volume that has multiple snapshots. The examiner wants to preserve the state of the file system at a specific point in time. Which acquisition method is most appropriate?
Select an answer first
3foundation · easy
Which Linux file system is known for its scalability and is often used on large servers and high-performance computing environments?
Select an answer first
4expert · hard
A Linux administrator is investigating a server that was compromised. The attacker deleted several log files from /var/log. The root filesystem is ext4. Which method is most likely to recover the deleted log files?
Select an answer first
5foundation · easy
In a modern Linux system using systemd, which process is the first user-space process started by the kernel?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 1)

Questions 1–5

On a Mac with an Intel processor, which firmware type is used during the boot process?

A forensic examiner needs to acquire data from a Mac with an APFS volume that has multiple snapshots. The examiner wants to preserve the state of the file system at a specific point in time. Which acquisition method is most appropriate?

Which Linux file system is known for its scalability and is often used on large servers and high-performance computing environments?

A Linux administrator is investigating a server that was compromised. The attacker deleted several log files from /var/log. The root filesystem is ext4. Which method is most likely to recover the deleted log files?

In a modern Linux system using systemd, which process is the first user-space process started by the kernel?

Keep studying — Storage Media and Data Acquisition