A user accidentally deleted a critical spreadsheet from an NTFS-formatted external drive. The drive has been used minimally since the deletion. The user wants to recover the file. Which recovery method is most likely to succeed?

Reinstall the operating system and use system restore points.

Perform a full data carving of the drive for spreadsheet signatures.

Use a file recovery tool that reads the NTFS $MFT and attempts to recover the file record.

Copy the entire drive to another drive using a standard copy command and then search for the file.

A forensic examiner is analyzing a Linux system that uses ext4. The examiner needs to determine the exact time a file was deleted. The file system has been mounted and used since the deletion. Which source of metadata is most likely to provide the deletion time?

The file's inode ctime will show the deletion time.

The file's atime will show the last access time before deletion.

The ext4 journal (journal) may contain a record of the deletion operation.

The directory entry's mtime will show the deletion time.

Which technique is commonly used to recover a deleted file when the file system metadata is still available?

Using the file system's allocation table or inode to locate the data blocks

Reconstructing the file from the file system's journal

Data carving based on file signatures

Scanning the entire disk for the file name string

A forensic examiner is working on a case where the evidence drive is a solid-state drive (SSD) that supports TRIM. The examiner needs to recover deleted files. The SSD has been in use for several weeks since the deletion. What is the most important consideration?

The SSD's wear leveling may have moved the data, making recovery difficult.

The TRIM command may have permanently erased the deleted data.

The SSD's firmware may have a backup of the deleted data.

The SSD's controller may have cached the data, making recovery easier.

A forensic examiner is about to analyze a hard drive that is part of a legal case. The examiner needs to ensure that the evidence is preserved and that the chain of custody is maintained. Which action is most important to take before starting the analysis?

Boot the computer to ensure the drive is functioning.

Copy the drive using a standard copy command.

Create a cryptographic hash of the original drive and document it.

Install forensic software on the suspect's computer.

EC-CouncilDigital Forensics Essentials

Domain 2Objective 3

File System Analysis and Data Recovery DFE Practice Questions (Page 1)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

41questions here

9free pages

7concepts

Questions 1–5

1application · medium
A user accidentally deleted a critical spreadsheet from an NTFS-formatted external drive. The drive has been used minimally since the deletion. The user wants to recover the file. Which recovery method is most likely to succeed?
Select an answer first
2expert · hard
A forensic examiner is analyzing a Linux system that uses ext4. The examiner needs to determine the exact time a file was deleted. The file system has been mounted and used since the deletion. Which source of metadata is most likely to provide the deletion time?
Select an answer first
3foundation · easy
Which technique is commonly used to recover a deleted file when the file system metadata is still available?
Select an answer first
4expert · hard
A forensic examiner is working on a case where the evidence drive is a solid-state drive (SSD) that supports TRIM. The examiner needs to recover deleted files. The SSD has been in use for several weeks since the deletion. What is the most important consideration?
Select an answer first
5application · easy
A forensic examiner is about to analyze a hard drive that is part of a legal case. The examiner needs to ensure that the evidence is preserved and that the chain of custody is maintained. Which action is most important to take before starting the analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.