Data Deletion and File Recovery Concepts DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An investigator is examining an NTFS volume and finds that the MFT entry for a deleted file is still present, but the file's data runs are marked as unallocated. What does this indicate about the deletion and the recovery potential?

   • AThe file was encrypted, and the MFT entry contains the decryption key.
   • BThe file was physically deleted; the MFT entry is a remnant and the data is irretrievably lost.
   • CThe file system journal has already overwritten the MFT entry, so recovery is impossible.
   • DThe file was logically deleted; the data clusters are unallocated and may be recoverable via carving or MFT entry analysis.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A user deleted a file from a USB drive and then immediately removed the drive. The drive is now being analyzed. The file system is FAT32. What is the most likely state of the file's data?

   • AThe data has been physically erased by the TRIM command
   • BThe data has been overwritten by the file system's journal
   • CThe data is only recoverable if the Recycle Bin was used
   • DThe data is intact in the clusters and can be recovered by carving
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A user reports that they accidentally deleted a folder containing multiple files from a network share. The share is hosted on a Windows Server with NTFS. The user did not use the Recycle Bin because the share is configured to bypass it. What is the BEST first step for the administrator to attempt recovery?

   • ACheck if Volume Shadow Copies (VSS) are enabled on the server and restore the folder from a previous snapshot.
   • BUse a file recovery tool on the server to scan for the deleted files.
   • CImmediately shut down the server and perform forensic recovery on the disk.
   • DRestore the folder from the server's backup tapes.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A forensic examiner is analyzing a USB drive formatted with FAT32. A user deleted a file and then ran a disk check utility (CHKDSK) on the drive. The examiner wants to recover the deleted file. What is the most likely impact of the CHKDSK on the recovery?

   • ACHKDSK has overwritten the file's data with zeros
   • BCHKDSK has permanently erased the file's data
   • CCHKDSK may have moved or altered the deleted file's directory entry, but the data may still be recoverable
   • DCHKDSK has made the file unrecoverable because it modifies the FAT
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A forensic examiner is analyzing a Windows system with NTFS. A file was deleted, and the examiner wants to recover it. The examiner notices that the file was stored in a single contiguous run on the disk. What is the most likely outcome of the recovery attempt?

   • AThe file can only be recovered if the MFT entry is intact
   • BThe file is unrecoverable because NTFS uses a journal that overwrites deleted data
   • CThe file cannot be recovered because NTFS does not support contiguous files
   • DThe file can be easily recovered by carving because it is contiguous
   Reveal Solution Discussion Select an answer first