When a file is deleted in a typical filesystem, what happens to the file's data blocks?

They are marked as free but their contents remain until overwritten

They are moved to a hidden recovery folder

They are encrypted to prevent recovery

They are immediately overwritten with zeros

A forensic examiner is comparing APFS and ext4 for a case involving a Mac and a Linux system. The examiner needs to explain a key difference that affects forensic recovery. Which statement is accurate?

APFS uses copy-on-write and snapshots, while ext4 uses journaling and extents.

APFS uses a bitmap for block allocation, while ext4 uses extents.

APFS uses inodes, while ext4 uses MFT entries.

APFS supports journaling, while ext4 does not.

A forensic examiner is recovering a deleted file from an ext4 filesystem. The file was 10 MB and was stored in 4 KB blocks. The examiner finds the inode, but the block pointers are partially overwritten. The examiner has identified a contiguous run of 2560 blocks that likely contains the file's data. Which approach is most reliable to confirm the file's data?

Carve the data using file signatures and validate with file metadata.

Use `foremost` to recover the file based on its header and footer.

Use `photorec` to recover the file from the unallocated space.

Use `debugfs` to read the inode's block pointers and reconstruct the file.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 1

Filesystem Fundamentals GBFA Practice Questions (Page 1)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
When a file is deleted in a typical filesystem, what happens to the file's data blocks?
Select an answer first
2foundation · easy
Which file allocation method stores a file's data in a single contiguous series of blocks on disk?
Select an answer first
3foundation · easy
Which of the following is a journaling filesystem commonly used on Linux?
Select an answer first
4expert · hard
A forensic examiner is comparing APFS and ext4 for a case involving a Mac and a Linux system. The examiner needs to explain a key difference that affects forensic recovery. Which statement is accurate?
Select an answer first
5expert · hard
A forensic examiner is recovering a deleted file from an ext4 filesystem. The file was 10 MB and was stored in 4 KB blocks. The examiner finds the inode, but the block pointers are partially overwritten. The examiner has identified a contiguous run of 2560 blocks that likely contains the file's data. Which approach is most reliable to confirm the file's data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Filesystem Fundamentals GBFA Practice Questions (Page 1)

Questions 1–5

When a file is deleted in a typical filesystem, what happens to the file's data blocks?

Which file allocation method stores a file's data in a single contiguous series of blocks on disk?

Which of the following is a journaling filesystem commonly used on Linux?

A forensic examiner is comparing APFS and ext4 for a case involving a Mac and a Linux system. The examiner needs to explain a key difference that affects forensic recovery. Which statement is accurate?

Keep studying — Filesystems and Data Storage