Data Deletion and File Recovery Concepts DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic analyst is recovering deleted files from a USB drive that was used on both Windows and Linux systems. The drive is formatted with exFAT. Which recovery technique is MOST appropriate?

   • ARestore files from the Recycle Bin, since both OSes support it.
   • BRecover files from the ext4 journal, since Linux may have journaled the writes.
   • CUse file carving on the raw image, since exFAT has limited metadata for deleted files.
   • DAnalyze the NTFS MFT entries, since Windows may have created them.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An investigator is analyzing a Linux system with an ext4 file system. A file was deleted, and the investigator wants to determine when the file was deleted. Which metadata source is MOST useful?

   • AThe file's access time (atime) from the inode.
   • BThe inode's deletion time field (dtime).
   • CThe file system journal's transaction timestamps.
   • DThe directory entry's modification time (mtime).
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security administrator is preparing a laptop for decommissioning. The requirement is to ensure that sensitive files cannot be recovered using forensic tools. Which approach BEST meets this requirement?

   • AUse the cipher /w command on the folder containing the sensitive files.
   • BDelete the sensitive files and then empty the Recycle Bin.
   • CReformat the hard drive with a quick format.
   • DPerform a full disk overwrite using a tool that writes multiple passes of random data.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A forensic examiner is analyzing a Linux system with ext4. A suspect deleted a file and then created a new file with the same name in the same directory. The examiner wants to recover the original deleted file. What is the most likely outcome?

   • AThe original file can be recovered from the ext4 journal, which stores file data
   • BThe original file can be recovered from the inode's direct block pointer
   • CThe original file's data blocks may have been overwritten by the new file, making recovery difficult
   • DThe original file can be recovered from the Recycle Bin
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A forensic examiner needs to recover deleted files from a Windows system. Which approach is most appropriate for recovering files that were logically deleted and whose MFT records are still intact?

   • AUsing a forensic tool to parse the MFT and recover the file's data runs from unallocated space.
   • BRebuilding the file system from scratch using the journal.
   • CUsing a file carving tool to scan for file signatures without using the MFT.
   • DPerforming a full disk wipe to ensure no data is missed.
   Reveal Solution Discussion Select an answer first