File System Analysis and Data Recovery DFE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A forensic examiner is trying to recover a deleted file from an NTFS volume. The file was large and fragmented. The examiner has identified the file's $MFT record, but the data runs are not contiguous. Which technique is most likely to recover the file's content?

   • ASearch the $LogFile for the file's data.
   • BPerform data carving on the unallocated space.
   • CUse the $MFT record's data runs to locate and reassemble the fragments.
   • DUse a tool that only recovers contiguous files.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A user deleted a file from a USB drive formatted with FAT32. The drive has been used to store other files since the deletion. The user wants to recover the original file. Which factor most affects the likelihood of successful recovery?

   • AThe file's original creation time.
   • BThe size of the file relative to the drive's cluster size.
   • CThe number of files in the same directory.
   • DWhether the file's clusters have been overwritten by new data.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An organization is choosing a file system for a new forensic analysis workstation. The workstation will be used to analyze evidence from various sources. Which file system feature is most important for forensic analysis?

   • ASupport for extended attributes to store additional metadata.
   • BSupport for preserving file creation, modification, and access times.
   • CSupport for snapshots to capture the state of the file system.
   • DSupport for journaling to maintain file system consistency.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic analyst is using The Sleuth Kit (TSK) to analyze a disk image. The analyst wants to recover deleted files from an NTFS partition. Which TSK tool should the analyst use to list deleted files?

   • A`icat`
   • B`fls`
   • C`ils`
   • D`mactime`
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of creating a forensic image of a storage device before performing data recovery?

   • ATo preserve the original evidence and work on a copy to avoid altering the source
   • BTo remove malware from the storage device
   • CTo speed up the recovery process by compressing the data
   • DTo convert the file system to a more modern format
   Reveal Solution Discussion Select an answer first