File System Analysis and Data Recovery DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A forensic analyst is using a tool to recover deleted files from a FAT32-formatted USB drive. The analyst has already created a forensic image. Which tool is specifically designed for file carving and can recover files based on signatures?

   • AThe Sleuth Kit (TSK)
   • BAutopsy
   • Cdd
   • DForemost
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic examiner is analyzing a USB drive that was used on a Windows 10 system. The drive is formatted with NTFS. The examiner needs to recover a deleted document that was stored in a folder that has since been deleted. The examiner has an image of the drive and wants to identify the file's original name and path. Which approach is most likely to yield this information?

   • AUse a hex editor to search for the file's content signature in the entire image.
   • BRun data carving on the unallocated space using file signatures.
   • CParse the NTFS $MFT and $LogFile to locate the file record and reconstruct the path.
   • DCheck the Recycle Bin folder for the deleted file.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic examiner is about to recover deleted files from a hard drive that is part of an ongoing legal case. The examiner needs to ensure that the evidence is admissible in court. Which practice is most critical?

   • ARecover as many files as possible to strengthen the case.
   • BUse the most advanced recovery tool available.
   • CPerform the recovery on the original drive to avoid questions about copying.
   • DDocument every step of the recovery process and maintain a chain of custody.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A forensic analyst is examining a Linux system that was used to store sensitive documents. The system uses the ext4 file system. The analyst needs to determine when a specific file was last accessed and when its metadata was last changed. Which metadata fields should the analyst examine?

   • Aatime and ctime
   • Bmtime and birth time
   • Cctime and mtime
   • Datime and mtime
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A forensic examiner is called to a scene where a computer is running and the suspect is still logged in. The examiner needs to preserve evidence, but the organization's policy requires minimizing downtime. The examiner has a write-blocker and imaging tools. What is the best course of action?

   • ACopy the entire hard drive using a standard copy command.
   • BAsk the suspect to log off to preserve the system state.
   • CCapture volatile data first, then create a forensic image using a write-blocker.
   • DImmediately pull the power plug to freeze the system state.
   Reveal Solution Discussion Select an answer first