When a file is deleted from a FAT-formatted drive, what happens to the file's data clusters?

The data is encrypted to prevent recovery

The data is immediately overwritten with zeros

The data is moved to a hidden system area

The data remains in the clusters until overwritten by new data

A forensic examiner is acquiring a drive that is part of a RAID 0 array. The array is currently offline because one drive has failed. The examiner needs to recover data from the remaining drive. What is the best approach?

Acquire the failed drive first, then the remaining drive.

Perform a logical acquisition of the array using the operating system's volume manager.

Attempt to rebuild the array by replacing the failed drive with a new one.

Acquire the remaining drive and attempt to reconstruct the array using the known stripe size and order.

What is the primary purpose of file carving in data recovery?

To compress files to save storage space

To repair damaged file system structures

To recover files based on their content signatures without relying on file system metadata

To securely erase deleted files

A forensic team is acquiring a drive that uses 4K native sectors. The imaging tool reports that the drive has 512-byte logical sectors. What is the most likely situation?

The imaging tool is misreading the drive's sector size.

The drive uses Advanced Format with 4K physical sectors but emulates 512-byte logical sectors for compatibility.

The drive is actually a 512-byte sector drive and the 4K report is an error.

The drive has been partitioned with a 4K sector size.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 3

Data on Drives GBFA Practice Questions (Page 4)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

Questions 16–20

16foundation · easy
When a file is deleted from a FAT-formatted drive, what happens to the file's data clusters?
Select an answer first
17expert · hard
A forensic examiner is acquiring a drive that is part of a RAID 0 array. The array is currently offline because one drive has failed. The examiner needs to recover data from the remaining drive. What is the best approach?
Select an answer first
18application · easy
A forensic examiner is analyzing a drive that uses 4K native sectors. The file system is NTFS with a cluster size of 4,096 bytes. How many sectors are in each cluster?
Select an answer first
19foundation · easy
What is the primary purpose of file carving in data recovery?
Select an answer first
20application · medium
A forensic team is acquiring a drive that uses 4K native sectors. The imaging tool reports that the drive has 512-byte logical sectors. What is the most likely situation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.