Data Deletion and File Recovery Concepts DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A system administrator is preparing a decommissioned laptop for disposal. The laptop has an SSD with TRIM enabled. The administrator wants to ensure that sensitive files are unrecoverable. Which action is most effective?

   • ARun a standard defragmentation tool on the SSD
   • BUse a disk sanitization tool that issues the ATA Secure Erase command
   • CUse the operating system's 'format' command and then reinstall the OS
   • DDelete the files and then empty the Recycle Bin
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic examiner is trying to recover a deleted JPEG image from a USB drive formatted with FAT32. The file was fragmented across three non-contiguous clusters. Which recovery method is most likely to succeed?

   • AUse file carving that reassembles fragments based on the JPEG's internal structure and headers/footers.
   • BRecover the file from the file system journal, which records all writes.
   • CAnalyze the FAT entries to reconstruct the file's cluster chain from the directory entry.
   • DRestore the file from the Recycle Bin, since FAT32 supports it.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A user reports that a sensitive spreadsheet was accidentally deleted from an NTFS volume on a Windows 10 workstation. The user immediately shut down the machine after realizing the mistake. A forensic examiner needs to recover the file. The examiner boots the system from a forensic USB drive and begins analysis. Which approach is most likely to recover the spreadsheet content?

   • ARestore the file from the Recycle Bin using the Windows recovery interface
   • BRun CHKDSK /F on the volume to repair the file system and recover the file
   • CCopy the entire volume to an image and then use the Windows 'Previous Versions' feature
   • DSearch the unallocated space for the file signature and perform file carving
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic examiner is investigating a case where a suspect deleted a critical PDF file from an NTFS volume. The examiner has a full disk image. The file was stored in a fragmented manner across the disk. The examiner has identified the MFT entry, but the data runs are incomplete. What is the most effective approach to recover the PDF?

   • AAnalyze the NTFS journal to reconstruct the file's original data runs
   • BPerform file carving using the PDF header and footer signatures, then manually reassemble fragments
   • CUse the Windows Previous Versions feature to restore the file
   • DRun a file system check (CHKDSK) to repair the MFT and recover the file
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In a Unix-like file system using inodes, what happens to the inode when a file is deleted?

   • AThe inode is encrypted, and the encryption key is stored in the superblock.
   • BThe inode is moved to a 'trash' directory, and the file can be restored from there.
   • CThe inode is immediately overwritten with zeros, and the data blocks are freed.
   • DThe inode's link count is decremented, and when it reaches zero, the inode is marked as free, but its contents may remain until reused.
   Reveal Solution Discussion Select an answer first