An investigator is examining a drive formatted with ext4 and finds a file that was deleted. The inode is still present, but the file's data blocks have been reallocated. What is the most likely outcome?

The file cannot be recovered because the data blocks have been overwritten.

The file can be partially recovered by using the inode to identify the original data blocks.

The file can be recovered from the journal if it was recently deleted.

The file can be fully recovered by using the inode to restore the data blocks.

An analyst is recovering deleted files from an ext4 filesystem. The files were deleted a week ago, and the system has been in use since then. Which type of data is most likely to be recoverable?

Files that were small enough to be stored in the inode itself.

Files whose data blocks have not been reallocated and overwritten.

Files that were in the root directory, as they are less likely to be overwritten.

Files that were stored in the journal and have not been overwritten.

A law enforcement team needs to acquire the RAM and the hard drive of a running Windows system that contains an encrypted volume. The system is currently in use, and the encryption key is loaded in memory. Which acquisition method should be used to preserve the ability to decrypt the drive later?

Perform a static acquisition of the hard drive first, then a live acquisition of RAM.

Perform only a live acquisition of RAM and skip the hard drive acquisition.

Perform a static acquisition of the hard drive after gracefully shutting down the system.

Perform a live acquisition of RAM first, then a static acquisition of the hard drive.

A first responder must acquire a laptop that is currently running and has an SSD with TRIM enabled. The laptop is suspected of containing deleted files that the responder wants to recover. What is the best course of action?

Boot the laptop from a forensic CD and then acquire the SSD.

Perform a live acquisition of the SSD while the system is running.

Run a defragmentation tool on the SSD before acquisition.

Power off the laptop immediately and then perform a static acquisition of the SSD.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 3

Data on Drives GBFA Practice Questions (Page 6)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

Questions 26–30

26foundation · easy
In the context of drive data representation, what is the smallest addressable unit of storage on a hard disk drive?
Select an answer first
27application · medium
An investigator is examining a drive formatted with ext4 and finds a file that was deleted. The inode is still present, but the file's data blocks have been reallocated. What is the most likely outcome?
Select an answer first
28application · medium
An analyst is recovering deleted files from an ext4 filesystem. The files were deleted a week ago, and the system has been in use since then. Which type of data is most likely to be recoverable?
Select an answer first
29application · medium
A law enforcement team needs to acquire the RAM and the hard drive of a running Windows system that contains an encrypted volume. The system is currently in use, and the encryption key is loaded in memory. Which acquisition method should be used to preserve the ability to decrypt the drive later?
Select an answer first
30application · medium
A first responder must acquire a laptop that is currently running and has an SSD with TRIM enabled. The laptop is suspected of containing deleted files that the responder wants to recover. What is the best course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.