A forensic analyst is examining a 64 MB FAT16 volume from an old digital camera. The analyst needs to recover a deleted 100 KB JPEG file. The volume's cluster size is 4 KB. The FAT shows that the file's first cluster is 5, and the FAT entry for cluster 5 contains the value 6. What does this value indicate?

Cluster 5 is the last cluster of the file.

The file's data continues in cluster 6.

The file occupies exactly one cluster.

During a forensic examination of an ext4 filesystem, an analyst uses `debugfs` to examine an inode for a recently deleted file. The inode's `i_blocks` field shows 8 (in 512-byte units) and `i_size` shows 4096. The file's data blocks are listed as 100, 101, 102, and 103. Which statement best describes the file's allocation?

The file uses indirect blocks to point to its data.

The file's data is stored in a single extent of 8 blocks.

The file is stored in four contiguous blocks, which is typical for a small file.

The file is fragmented across four non-contiguous blocks.

A forensic examiner is analyzing a filesystem that uses linked allocation. The examiner finds a deleted file's first block, which contains a pointer to the next block. The examiner wants to recover the entire file. Which challenge is most significant?

The file's blocks are stored contiguously, so recovery is straightforward.

The linked list may be broken if any block in the chain has been overwritten or reallocated.

The file's data is encrypted, making recovery impossible without the key.

The file's inode contains the starting block, but the file size is unknown.

During a forensic examination of an ext4 filesystem, an analyst finds a deleted file that is still referenced by an open file handle on a running system. The analyst needs to recover the file content without powering down the system. Which approach is most likely to succeed?

Use `debugfs` to dump the inode after unmounting the filesystem.

Copy the file from the `/proc/ /fd/` directory of the process that has the file open.

Search the raw disk for the file's content using `grep` on the block device.

Run `extundelete` on the mounted filesystem to recover the inode.

A forensic analyst is documenting the storage layout of a disk. The analyst needs to explain the relationship between sectors, clusters, and blocks to a colleague. Which statement is accurate?

Blocks are larger than clusters, and clusters are composed of blocks.

A sector is a logical grouping of clusters, and blocks are physical disk units.

Clusters are always 4 KB, and blocks are always 512 bytes.

A cluster is a group of sectors, and a filesystem block is often the same as or a multiple of the cluster size.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 1

Filesystem Fundamentals GBFA Practice Questions (Page 3)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 11–15

11application · medium
A forensic analyst is examining a 64 MB FAT16 volume from an old digital camera. The analyst needs to recover a deleted 100 KB JPEG file. The volume's cluster size is 4 KB. The FAT shows that the file's first cluster is 5, and the FAT entry for cluster 5 contains the value 6. What does this value indicate?
Select an answer first
12application · medium
During a forensic examination of an ext4 filesystem, an analyst uses `debugfs` to examine an inode for a recently deleted file. The inode's `i_blocks` field shows 8 (in 512-byte units) and `i_size` shows 4096. The file's data blocks are listed as 100, 101, 102, and 103. Which statement best describes the file's allocation?
Select an answer first
13expert · medium
A forensic examiner is analyzing a filesystem that uses linked allocation. The examiner finds a deleted file's first block, which contains a pointer to the next block. The examiner wants to recover the entire file. Which challenge is most significant?
Select an answer first
14application · medium
During a forensic examination of an ext4 filesystem, an analyst finds a deleted file that is still referenced by an open file handle on a running system. The analyst needs to recover the file content without powering down the system. Which approach is most likely to succeed?
Select an answer first
15application · medium
A forensic analyst is documenting the storage layout of a disk. The analyst needs to explain the relationship between sectors, clusters, and blocks to a colleague. Which statement is accurate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Filesystem Fundamentals GBFA Practice Questions (Page 3)

Questions 11–15

A forensic examiner is analyzing a filesystem that uses linked allocation. The examiner finds a deleted file's first block, which contains a pointer to the next block. The examiner wants to recover the entire file. Which challenge is most significant?

During a forensic examination of an ext4 filesystem, an analyst finds a deleted file that is still referenced by an open file handle on a running system. The analyst needs to recover the file content without powering down the system. Which approach is most likely to succeed?

A forensic analyst is documenting the storage layout of a disk. The analyst needs to explain the relationship between sectors, clusters, and blocks to a colleague. Which statement is accurate?

Keep studying — Filesystems and Data Storage