Data Deletion and File Recovery Concepts DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is trying to recover a deleted video file from an SSD that uses TRIM. The file was deleted a week ago. What is the MOST significant obstacle to recovery?

   • AThe SSD's TRIM command may have already erased the deleted data blocks at the flash level.
   • BThe file system journal has overwritten the file's metadata.
   • CThe video file's fragmentation makes carving impossible.
   • DThe SSD's wear leveling has moved the data to an inaccessible location.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic examiner is trying to recover a deleted database file from a server that uses LVM (Logical Volume Manager) on top of ext4. The file was deleted, and the LVM snapshot was taken after deletion. What is the BEST source for recovery?

   • AAnalyze the LVM snapshot, which contains the file system state at the time of the snapshot.
   • BRecover the file from the LVM metadata, which stores file data.
   • CUse file carving on the live file system, since the data is still in unallocated space.
   • DAnalyze the ext4 journal to recover the file's data blocks.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic examiner is analyzing a Windows system with NTFS. A suspect deleted a file and then used a secure deletion tool that overwrites the file's data with random data before deleting it. The examiner has an image of the disk. What is the most likely outcome of attempting to recover the deleted file?

   • AThe file can be recovered from the Recycle Bin, which is not affected by the secure deletion tool
   • BThe file can be recovered from the NTFS journal, which stores file data
   • CThe file's data has been overwritten and is unrecoverable
   • DThe file can be recovered from the MFT entry, which still contains the data
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A user deletes a file by pressing Shift+Delete in Windows, bypassing the Recycle Bin. Which statement best describes what happens to the file's data on a traditional hard disk drive?

   • AThe data is immediately overwritten with zeros, making recovery impossible.
   • BThe file's directory entry and MFT record are marked as free, but the data blocks remain intact until overwritten.
   • CThe file's data is encrypted and then marked for deletion, requiring a special key to recover.
   • DThe file's data is moved to a hidden system folder, making it invisible but still present.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which factor most directly reduces the likelihood of recovering a deleted file?

   • AThe file's data blocks have been overwritten by new data.
   • BThe file system uses journaling.
   • CThe file was stored on a solid-state drive (SSD).
   • DThe file was deleted using the Recycle Bin.
   Reveal Solution Discussion Select an answer first