A forensic examiner is analyzing an NTFS volume that was subject to a power failure. The examiner needs to determine whether the `$LogFile` contains transactions that were not replayed. Which approach is most appropriate?

Check the `$Bitmap` to see if any clusters are marked as allocated but not referenced by any MFT entry.

Compare the `$LogFile` size to the MFT size to estimate un-replayed transactions.

Run `chkdsk /f` on the volume to replay the journal and then compare the MFT before and after.

Examine the `$LogFile` for records with a sequence number higher than the last replayed sequence number.

A forensic examiner is analyzing an ext4 filesystem and finds an inode with a link count of zero. The inode is not marked as free in the inode bitmap. What does this indicate?

The inode is corrupted and should be ignored.

The file was deleted, but the inode is still in use by an open process, so the data blocks are still allocated.

The file is a symbolic link, which does not use an inode.

The file has multiple hard links, and one was removed.

A forensic examiner is analyzing an ext4 filesystem after an unclean shutdown. The examiner wants to understand how the journal can help recover metadata changes. Which statement best describes the role of the ext4 journal?

The journal stores a full backup of all file contents for disaster recovery.

The journal maintains a list of deleted files for forensic recovery.

The journal records metadata transactions so the filesystem can replay or roll back to a consistent state.

The journal is used to encrypt metadata for security.

A forensic examiner is trying to recover a deleted file from an NTFS volume. The file was 5 KB and was stored in a single cluster. The examiner finds the MFT entry, but the `$DATA` attribute is non-resident and the data run is partially overwritten. The examiner also finds a copy of the file's content in unallocated space. Which approach is most reliable to recover the file?

Use the MFT entry's data run to read the file from the original cluster.

Use `icat` with the MFT entry number to extract the file.

Carve the file from unallocated space using file signatures and validate with the MFT metadata.

Use `photorec` to recover the file from the unallocated space.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 1

Filesystem Fundamentals GBFA Practice Questions (Page 5)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 21–25

21foundation · easy
Which filesystem is the default for Windows and supports features such as file-level security, journaling, and large volume sizes?
Select an answer first
22expert · hard
A forensic examiner is analyzing an NTFS volume that was subject to a power failure. The examiner needs to determine whether the `$LogFile` contains transactions that were not replayed. Which approach is most appropriate?
Select an answer first
23expert · medium
A forensic examiner is analyzing an ext4 filesystem and finds an inode with a link count of zero. The inode is not marked as free in the inode bitmap. What does this indicate?
Select an answer first
24application · medium
A forensic examiner is analyzing an ext4 filesystem after an unclean shutdown. The examiner wants to understand how the journal can help recover metadata changes. Which statement best describes the role of the ext4 journal?
Select an answer first
25expert · hard
A forensic examiner is trying to recover a deleted file from an NTFS volume. The file was 5 KB and was stored in a single cluster. The examiner finds the MFT entry, but the `$DATA` attribute is non-resident and the data run is partially overwritten. The examiner also finds a copy of the file's content in unallocated space. Which approach is most reliable to recover the file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Filesystem Fundamentals GBFA Practice Questions (Page 5)

Questions 21–25

Which filesystem is the default for Windows and supports features such as file-level security, journaling, and large volume sizes?

A forensic examiner is analyzing an NTFS volume that was subject to a power failure. The examiner needs to determine whether the `$LogFile` contains transactions that were not replayed. Which approach is most appropriate?

A forensic examiner is analyzing an ext4 filesystem and finds an inode with a link count of zero. The inode is not marked as free in the inode bitmap. What does this indicate?

A forensic examiner is analyzing an ext4 filesystem after an unclean shutdown. The examiner wants to understand how the journal can help recover metadata changes. Which statement best describes the role of the ext4 journal?

Keep studying — Filesystems and Data Storage