File System Analysis and Data Recovery DFE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary basis for data carving to recover files?

   • AUnique file content signatures and file structure patterns
   • BThe file's access control list
   • CFile system metadata such as the MFT or inode
   • DThe file's original name and path in the directory
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which practice is essential for maintaining the chain of custody during evidence preservation?

   • ADocumenting every person who handles the evidence and when
   • BDeleting all temporary files after analysis
   • CUsing the original device for all analysis
   • DStoring the evidence on a public cloud server
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic examiner is recovering files from a damaged SD card. The file system is partially corrupted, and some directory entries are unreadable. The examiner wants to recover as many photos as possible. Which approach is most effective?

   • AOnly use file system recovery tools to preserve metadata.
   • BUse a combination of file system recovery and data carving.
   • CReformat the SD card and then recover files.
   • DOnly use data carving to avoid dealing with the corrupted file system.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A forensic analyst is using a tool to recover deleted files from an image. The analyst wants to ensure that the recovery process does not alter the original image. Which practice is essential?

   • ARun the recovery tool directly on the original image to save time.
   • BUse a tool that automatically modifies the image to repair errors.
   • CWork on a copy of the image and verify its hash before and after analysis.
   • DDisable the write blocker after creating the image to speed up recovery.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An examiner is analyzing a file on an ext4 file system. The examiner wants to determine if the file content was modified after the file was created. Which timestamp comparison is most useful?

   • ACompare the atime and mtime.
   • BCompare the birth time and ctime.
   • CCompare the ctime and mtime.
   • DCompare the atime and ctime.
   Reveal Solution Discussion Select an answer first