Data on Drives GBFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is examining an NTFS drive and finds that a file's $MFT entry is marked as deleted, but the file's data runs are still intact. The analyst wants to recover the file. What is the most reliable method?

   • ARun a file-carving tool that searches for the file signature in unallocated space.
   • BCopy the file from the Recycle Bin.
   • CRestore the system to a previous restore point.
   • DUse a tool that parses the $MFT and reconstructs the file from the data runs in the deleted entry.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A forensic team must acquire a server that is running a critical application. The server has a hardware RAID controller with a battery-backed cache. The team needs to preserve the live state of the application and also acquire the physical drives. The application is writing data continuously. What is the best approach?

   • APerform a live acquisition of the logical volume, then shut down the server and acquire the physical drives.
   • BShut down the server immediately and acquire the physical drives.
   • CUse the RAID controller's snapshot feature to create a consistent snapshot, then acquire the snapshot and the physical drives.
   • DPerform only a live acquisition of the logical volume and skip the physical drives.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A field team must image a 4 TB NTFS drive from a compromised server. The drive has 4 KB clusters and the NTFS $MFT is heavily fragmented. The team needs to preserve the original data layout and capture unallocated space. Which acquisition approach best meets these requirements?

   • APerform a live acquisition by booting the server and copying the $MFT and $LogFile to an external drive.
   • BPerform a logical acquisition of the active file system using a forensic tool that reads files via the $MFT.
   • CPerform a physical acquisition of the entire drive using a hardware write blocker and a forensic imager.
   • DPerform a sparse acquisition that only reads clusters referenced by the $MFT.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is recovering deleted files from an NTFS drive. The drive has a large amount of unallocated space, and the analyst finds several deleted $MFT entries. Some entries have intact data runs, while others have been partially overwritten. What is the most efficient recovery strategy?

   • AAttempt to recover all files using only the $MFT entries, ignoring damaged entries.
   • BRun a file system repair tool to rebuild the $MFT, then recover files.
   • CCarve the entire unallocated space first, then use the $MFT entries to validate the carved files.
   • DPrioritize recovery of files with intact data runs, then use carving for files with damaged entries.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary advantage of static acquisition over live acquisition for forensic imaging?

   • AIt allows capture of volatile memory contents
   • BIt does not require write-blocking hardware
   • CIt is always faster than live acquisition
   • DIt produces a more consistent and reliable image because the system is not changing during acquisition
   Reveal Solution Discussion Select an answer first