Data Deletion and File Recovery Concepts DFE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An investigator needs to recover a deleted file from a laptop that was used for a week after deletion. The laptop has an SSD with TRIM enabled. The file was small (10 KB) and was stored in the MFT itself (resident). What is the MOST likely outcome and why?

   • AThe file is unrecoverable because TRIM erases the MFT entry.
   • BThe file is likely recoverable because resident files are stored in the MFT, which is not affected by TRIM.
   • CThe file is recoverable only through carving, since TRIM destroys the MFT entry.
   • DThe file is unrecoverable because the MFT entry was overwritten during the week of use.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is attempting to recover a deleted document from an ext4 file system. The file was deleted two weeks ago, and the system has been in heavy use since. The analyst finds the inode is still present, but the data blocks are marked free. What is the MOST significant challenge to recovery?

   • AThe inode's deletion time cannot be determined from the metadata.
   • BThe file was encrypted at rest, making the data blocks unreadable.
   • CThe file system journal has purged all records of the file's data blocks.
   • DThe data blocks may have been overwritten by new files created during the two weeks of heavy use.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A forensic examiner is analyzing a USB drive formatted with exFAT. A user deleted several large video files and then copied new files to the drive. The examiner wants to recover the deleted videos. What is the most significant challenge?

   • AThe exFAT journal has overwritten the deleted files' data
   • BThe deleted videos are in the Recycle Bin and cannot be recovered
   • CThe new files may have overwritten the deleted videos' clusters
   • DexFAT does not support file recovery
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A forensic examiner is recovering files from a Linux server that uses ext4 with journaling. A critical file was deleted, and the examiner finds the inode is still present, but the data blocks are marked free. The file system has been mounted and used since deletion. What is the BEST approach to maximize recovery?

   • AUse the ext4 journal to replay the file's data blocks from the journal.
   • BUnmount the file system immediately and analyze a forensic image using carving and inode analysis.
   • CRun a recovery tool on the live system to scan for the deleted file.
   • DReboot the system into single-user mode to prevent further writes.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic examiner is analyzing a Windows 10 system with NTFS. A suspect deleted a critical document using Shift+Delete. The examiner has an image of the disk. Which location should be examined first to find remnants of the deleted file?

   • AThe Recycle Bin's $I and $R files
   • BThe MFT $STANDARD_INFORMATION attribute and the unallocated space
   • CThe pagefile.sys file
   • DThe Windows Prefetch files
   Reveal Solution Discussion Select an answer first