In which scenario is data carving most likely to be necessary?

When the file system metadata is intact and the file was deleted normally

When the file is still open in an application

When the storage media has been formatted and the file system structures are partially or fully overwritten

When the file is stored on a read-only optical disc

A forensic examiner has been called to investigate a suspected data theft. The suspect's computer is running, and the examiner needs to preserve evidence. The examiner has a write-blocker and forensic imaging software. What is the first step the examiner should take?

Power off the computer immediately to prevent further changes.

Capture volatile data such as RAM and running processes before touching the disk.

Connect a write-blocker and create a forensic image of the hard drive.

Copy the suspect's files to an external drive for analysis.

An investigator is analyzing a Linux system that uses the ext4 file system. The investigator needs to determine when a specific file was last modified, when its metadata was last changed, and when it was last accessed. Which command or tool should the investigator use to view these timestamps?

Use the `cat` command to view the file content and timestamps.

Use the `file` command to view the file type and timestamps.

Use the `stat` command on the file.

Use the `ls -l` command to view the modification time.

In a file system, what is the primary purpose of the file allocation table or inode table?

To manage the physical rotation speed of the storage media

To encrypt all data stored on the volume

To store the actual contents of files and directories

To track which storage blocks belong to which files and to record file metadata

A forensic analyst is investigating a case where a suspect deleted a large video file from an NTFS drive. The drive has been used heavily since the deletion. The analyst needs to recover the video. Which approach is most likely to succeed?

Use data carving to recover the video from unallocated space.

Use the MFT to recover the file if the record is still present.

Use the $LogFile to recover the file content.

Use the Recycle Bin to restore the file.

EC-CouncilDigital Forensics Essentials

Domain 2Objective 3

File System Analysis and Data Recovery DFE Practice Questions (Page 7)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

41questions here

9free pages

7concepts

Questions 31–35

31foundation · easy
In which scenario is data carving most likely to be necessary?
Select an answer first
32application · medium
A forensic examiner has been called to investigate a suspected data theft. The suspect's computer is running, and the examiner needs to preserve evidence. The examiner has a write-blocker and forensic imaging software. What is the first step the examiner should take?
Select an answer first
33application · easy
An investigator is analyzing a Linux system that uses the ext4 file system. The investigator needs to determine when a specific file was last modified, when its metadata was last changed, and when it was last accessed. Which command or tool should the investigator use to view these timestamps?
Select an answer first
34foundation · easy
In a file system, what is the primary purpose of the file allocation table or inode table?
Select an answer first
35expert · medium
A forensic analyst is investigating a case where a suspect deleted a large video file from an NTFS drive. The drive has been used heavily since the deletion. The analyst needs to recover the video. Which approach is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.