A forensic examiner is analyzing a disk image from a Windows 10 system that uses BitLocker. The examiner needs to determine the partition layout and identify the BitLocker-encrypted partition. Which tool or method is most appropriate?

Use `icat` to extract the BitLocker metadata from the partition.

Use `fsstat` to read the filesystem metadata of the encrypted partition.

Use `mmls` to list the partition table and identify the partition type.

Use `fls` to list files on the encrypted partition.

A forensic examiner is analyzing a disk image from a Linux server that uses LVM. The examiner needs to acquire the logical volume that contains the `/home` directory. Which approach correctly identifies the logical volume?

Use `vgdisplay` and `lvdisplay` to map the logical volume to its physical extent.

Use `blkid` to identify the logical volume's UUID.

Use `fdisk -l` to list the logical volume as a partition.

Use `mount` to find the device path of the logical volume.

A forensic examiner is trying to recover a deleted file from an ext4 filesystem. The file was deleted recently, and the filesystem has not been heavily used since. Which approach is most likely to recover the file's content?

Use `foremost` to recover the file by searching for file headers.

Use `dd` to copy the entire disk and then run `grep` for known file content.

Use `extundelete` on a read-only copy of the filesystem to restore the file by inode number.

Use `photorec` to carve the file based on its signature, ignoring the filesystem metadata.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 1

Filesystem Fundamentals GBFA Practice Questions (Page 4)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 16–20

16application · medium
A forensic examiner is analyzing a disk image from a Windows 10 system that uses BitLocker. The examiner needs to determine the partition layout and identify the BitLocker-encrypted partition. Which tool or method is most appropriate?
Select an answer first
17foundation · easy
Which filesystem structure is most directly used by forensic tools to locate the starting cluster of a deleted file in a FAT filesystem?
Select an answer first
18application · medium
A forensic examiner is analyzing a disk image from a Linux server that uses LVM. The examiner needs to acquire the logical volume that contains the `/home` directory. Which approach correctly identifies the logical volume?
Select an answer first
19foundation · easy
Which filesystem type is the default for modern macOS system volumes and is characterized by copy-on-write metadata and strong encryption support?
Select an answer first
20application · medium
A forensic examiner is trying to recover a deleted file from an ext4 filesystem. The file was deleted recently, and the filesystem has not been heavily used since. Which approach is most likely to recover the file's content?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Filesystem Fundamentals GBFA Practice Questions (Page 4)

Questions 16–20

A forensic examiner is analyzing a disk image from a Windows 10 system that uses BitLocker. The examiner needs to determine the partition layout and identify the BitLocker-encrypted partition. Which tool or method is most appropriate?

Which filesystem structure is most directly used by forensic tools to locate the starting cluster of a deleted file in a FAT filesystem?

A forensic examiner is analyzing a disk image from a Linux server that uses LVM. The examiner needs to acquire the logical volume that contains the `/home` directory. Which approach correctly identifies the logical volume?

Which filesystem type is the default for modern macOS system volumes and is characterized by copy-on-write metadata and strong encryption support?

A forensic examiner is trying to recover a deleted file from an ext4 filesystem. The file was deleted recently, and the filesystem has not been heavily used since. Which approach is most likely to recover the file's content?

Keep studying — Filesystems and Data Storage