A forensic examiner is analyzing a disk image from a system that used a file system with journaling. The examiner needs to recover a file that was deleted just before the system crashed. Which technique is most likely to recover the file's content?

Examine the file system journal for remnants of the file's data blocks.

Perform data carving on the entire disk image.

Rebuild the file system from the journal and then recover the file.

Use a file recovery tool that relies on the file system's directory entries.

A forensic examiner is analyzing a disk image from a system that used a proprietary file system. The file system metadata is not recognized by the examiner's tools. The examiner needs to recover documents that were deleted. Which approach is most appropriate?

Manually parse the raw bytes to find file names and then extract the files.

Use data carving to search for file signatures (e.g., PDF, DOCX) in the raw image.

Convert the image to a different file system format and then recover files.

Install a driver for the proprietary file system and then use standard recovery tools.

A forensic examiner is recovering files from a disk image. The examiner knows that some files are fragmented. Which data carving technique is most appropriate to recover fragmented files?

Use a tool that only searches for file signatures in unallocated space.

Use a carving tool that performs file structure validation and reassembly.

Use a simple header-footer carving tool.

Use a tool that relies on file system metadata to locate fragments.

When a file is deleted in a typical file system, what happens to the file's data blocks?

They are immediately overwritten with zeros

They are moved to a hidden recovery folder

They are encrypted to prevent recovery

They are marked as free and may remain intact until overwritten

EC-CouncilDigital Forensics Essentials

Domain 2Objective 3

File System Analysis and Data Recovery DFE Practice Questions (Page 2)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

41questions here

9free pages

7concepts

Questions 6–10

6foundation · easy
In file system analysis, which metadata attribute is most useful for determining when a file was last modified?
Select an answer first
7expert · hard
A forensic examiner is analyzing a disk image from a system that used a file system with journaling. The examiner needs to recover a file that was deleted just before the system crashed. Which technique is most likely to recover the file's content?
Select an answer first
8application · medium
A forensic examiner is analyzing a disk image from a system that used a proprietary file system. The file system metadata is not recognized by the examiner's tools. The examiner needs to recover documents that were deleted. Which approach is most appropriate?
Select an answer first
9expert · hard
A forensic examiner is recovering files from a disk image. The examiner knows that some files are fragmented. Which data carving technique is most appropriate to recover fragmented files?
Select an answer first
10foundation · easy
When a file is deleted in a typical file system, what happens to the file's data blocks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.