Boot Processes and File Systems Across Windows, Linux, and macOS DFE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A forensic examiner is analyzing a Mac that runs macOS Monterey (12) with APFS. The examiner needs to determine whether a file was copied from an external drive or created locally. Which APFS feature would be most helpful?

   • AThe file's access time (atime) and the system's sleep/wake logs.
   • BThe file's extended attributes, which may include the source volume's UUID or a 'com.apple.provenance' attribute.
   • CThe file's POSIX permissions and ownership, which may differ between local and external drives.
   • DThe file's creation date (crtime) and the volume's UUID, which can be compared to the external drive's UUID.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which Linux file system was the first to introduce journaling, providing faster recovery after a crash?

   • AXFS
   • Bext4
   • Cext2
   • Dext3
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic examiner is analyzing a Mac that runs macOS Catalina. The examiner needs to recover deleted files from the internal SSD. Which file system feature should the examiner be aware of?

   • AAPFS does not support TRIM, so deleted data remains on the SSD.
   • BHFS+ is the default file system on macOS Catalina.
   • CAPFS uses copy-on-write, which may preserve older versions of files in snapshots.
   • DHFS+ uses a journal to speed up recovery of deleted files.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A forensic examiner is analyzing a Mac that runs macOS Mojave (10.14) with HFS+ as the boot volume. The examiner needs to recover a deleted file that was stored in a directory that has since been renamed. Which HFS+ feature is most helpful for this task?

   • AThe HFS+ Alternate Volume Header contains a backup of the Catalog File, which can be used to recover the deleted file.
   • BThe HFS+ Catalog File stores file and directory records, including the original directory name and the file's metadata, even after deletion.
   • CThe HFS+ journal (HFSJ) contains a record of the rename operation, which can help locate the original directory name and file.
   • DThe HFS+ Extents Overflow File contains the data blocks of the deleted file, which can be reassembled to recover the content.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic examiner needs to acquire data from a MacBook Pro that uses FileVault 2 encryption on an APFS volume. The examiner has the user's password. Which method should the examiner use to acquire a forensically sound image?

   • ABoot the Mac into Recovery Mode and use Disk Utility to create an image of the APFS volume.
   • BUse a hardware write-blocker and connect the drive to a forensic workstation, then image the raw device.
   • CBoot the Mac normally, log in with the user's password, and use a forensic tool to image the mounted volume.
   • DBoot into Target Disk Mode and use a forensic tool that supports APFS and FileVault decryption, providing the password when prompted.
   Reveal Solution Discussion Select an answer first