Data Deletion and File Recovery Concepts DFE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why does file fragmentation complicate the recovery of deleted files?

   • AFragmented files are deleted more quickly, leaving less time for recovery.
   • BFragmented files are stored in non-contiguous clusters, making it difficult to reassemble the file from raw data.
   • CFragmented files are moved to a different partition, making them harder to locate.
   • DFragmented files are automatically encrypted, making them unreadable.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic investigator is working on a case involving a Linux system using ext4. A suspect deleted several files and then ran a script that created and deleted many temporary files. The investigator wants to recover the original deleted files. What is the most significant challenge?

   • AThe file system was remounted read-only, preventing access to unallocated space
   • BThe ext4 journal has been rotated and no longer contains the deletion records
   • CThe deleted files' data blocks have likely been overwritten by the temporary files
   • DThe inodes for the deleted files have been zeroed by the script
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic analyst is attempting to recover a large video file that was deleted from an NTFS volume. The file was heavily fragmented across the disk. The analyst has identified the file's MFT entry, but the data runs are incomplete. What is the most effective next step to recover the video content?

   • AAnalyze the NTFS journal to reconstruct the file's original data runs
   • BUse the Windows Recycle Bin to restore the file
   • CRun a low-level format on the volume to recover the data
   • DPerform file carving using the video file's header and footer signatures
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An investigator is examining a Windows system where a user deleted a file and then ran a disk cleanup utility. The file was stored in a non-resident manner on an NTFS volume. The MFT entry is still present, but the data runs point to clusters that are now marked as free. What is the MOST likely impact of the disk cleanup utility on recovery?

   • AThe utility zeroed out the MFT entry, making recovery impossible.
   • BThe utility has no effect on recovery since the MFT entry is still present.
   • CThe utility may have triggered a TRIM command on the SSD, erasing the data clusters.
   • DThe utility overwrote the data clusters with zeros.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A forensic examiner is investigating a case involving a Windows system with NTFS. A suspect deleted a file and then ran a disk defragmentation tool. The examiner wants to recover the deleted file. What is the most likely impact of the defragmentation on the recovery?

   • AThe defragmentation has permanently erased the file's data
   • BThe defragmentation may have moved the file's data blocks, but the data may still be recoverable
   • CThe defragmentation has overwritten the file's data with zeros
   • DThe defragmentation has made the file unrecoverable because it modifies the MFT
   Reveal Solution Discussion Select an answer first