An investigator is examining an ext4 file system and finds a deleted file. The inode for the file has been cleared, but the data blocks are still present in unallocated space. What is the most effective way to recover the file?

Use the ext4 journal to recover the inode and data block pointers.

Use a file carving tool to search for the file's signature in unallocated space.

Use the ls -la command to list the deleted file in the directory.

Use the debugfs tool to recover the inode from the backup superblock.

A forensic team is responding to an incident where a suspect's laptop is running and the screen is locked. The team needs to acquire the RAM and the hard drive. What is the correct order of acquisition?

Acquire the RAM first, then perform a live acquisition of the hard drive.

Acquire the RAM and hard drive simultaneously using a hardware tool.

Power down the laptop, remove the hard drive, and acquire it with a write-blocker.

Perform a live acquisition of the hard drive first, then acquire the RAM.

An analyst is trying to recover a deleted file from a FAT32 drive. The directory entry is still present, but the file's starting cluster is 0. What does this indicate?

The file was fragmented and the starting cluster was lost.

The file was empty (0 bytes) when it was deleted.

The file was encrypted and the starting cluster is hidden.

The file was stored in the root directory and cannot be recovered.

An analyst is examining a FAT32 USB drive from which a user deleted a large document. The document was stored in a contiguous run of clusters. The analyst wants to recover the file with the highest chance of success. What should the analyst do first?

Rebuild the file system by running chkdsk on the USB drive.

Search the unallocated space for the file's name string.

Run a file-carving tool on the raw image to search for the file's signature.

Check the FAT and directory entry to see if the entry is still present and the cluster chain is intact.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 3

Data on Drives GBFA Practice Questions (Page 7)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

Questions 31–34

31application · medium
An investigator is examining an ext4 file system and finds a deleted file. The inode for the file has been cleared, but the data blocks are still present in unallocated space. What is the most effective way to recover the file?
Select an answer first
32expert · hard
A forensic team is responding to an incident where a suspect's laptop is running and the screen is locked. The team needs to acquire the RAM and the hard drive. What is the correct order of acquisition?
Select an answer first
33application · medium
An analyst is trying to recover a deleted file from a FAT32 drive. The directory entry is still present, but the file's starting cluster is 0. What does this indicate?
Select an answer first
34application · medium
An analyst is examining a FAT32 USB drive from which a user deleted a large document. The document was stored in a contiguous run of clusters. The analyst wants to recover the file with the highest chance of success. What should the analyst do first?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.