An analyst is examining a FAT32 USB drive from a suspect. The file allocation table shows a file marked as deleted, but the directory entry still exists. The analyst wants to recover the file. What is the most important factor that determines whether the file can be fully recovered?

Whether the clusters previously used by the file have been overwritten by new data.

Whether the file was stored in the root directory or a subdirectory.

Whether the drive was formatted with a quick format or a full format.

Whether the file system journal is enabled for the volume.

An analyst is examining a FAT32 drive and finds a deleted file. The directory entry shows the starting cluster, but the FAT chain is partially overwritten. The file is known to be fragmented. What is the best recovery strategy?

Run chkdsk to repair the FAT and then recover the file.

Carve the entire unallocated space for the file signature and reconstruct the file from fragments.

Use the directory entry's starting cluster and attempt to follow the FAT chain, filling in gaps with carving.

Copy the file from the Recycle Bin.

What is the primary purpose of Logical Block Addressing (LBA) on modern hard drives?

To secure data by encrypting the sector addresses

To define the file system's cluster size for optimal performance

To provide a linear addressing scheme that abstracts the physical geometry of the drive

To increase the physical storage capacity of the drive by compressing data

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 3

Data on Drives GBFA Practice Questions (Page 2)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

Questions 6–10

6application · medium
An analyst is examining a FAT32 USB drive from a suspect. The file allocation table shows a file marked as deleted, but the directory entry still exists. The analyst wants to recover the file. What is the most important factor that determines whether the file can be fully recovered?
Select an answer first
7application · easy
A forensic analyst is documenting the physical layout of a seized hard drive. The drive has a sector size of 512 bytes and the file system uses a cluster size of 4,096 bytes. How many sectors are contained in a single cluster?
Select an answer first
8application · easy
A forensic examiner is documenting the addressing scheme of a seized drive. The drive uses logical block addressing (LBA) and has a total of 1,000,000 sectors. What is the LBA of the last sector on the drive?
Select an answer first
9application · medium
An analyst is examining a FAT32 drive and finds a deleted file. The directory entry shows the starting cluster, but the FAT chain is partially overwritten. The file is known to be fragmented. What is the best recovery strategy?
Select an answer first
10foundation · easy
What is the primary purpose of Logical Block Addressing (LBA) on modern hard drives?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Data on Drives GBFA Practice Questions (Page 2)

Questions 6–10

An analyst is examining a FAT32 USB drive from a suspect. The file allocation table shows a file marked as deleted, but the directory entry still exists. The analyst wants to recover the file. What is the most important factor that determines whether the file can be fully recovered?

A forensic analyst is documenting the physical layout of a seized hard drive. The drive has a sector size of 512 bytes and the file system uses a cluster size of 4,096 bytes. How many sectors are contained in a single cluster?

A forensic examiner is documenting the addressing scheme of a seized drive. The drive uses logical block addressing (LBA) and has a total of 1,000,000 sectors. What is the LBA of the last sector on the drive?

An analyst is examining a FAT32 drive and finds a deleted file. The directory entry shows the starting cluster, but the FAT chain is partially overwritten. The file is known to be fragmented. What is the best recovery strategy?

What is the primary purpose of Logical Block Addressing (LBA) on modern hard drives?

Keep studying — Filesystems and Data Storage