Filesystem Fundamentals GBFA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A forensic examiner is analyzing a disk image from a Linux system that uses LVM. The examiner needs to acquire the logical volume that contains the `/var` directory. Which approach correctly identifies the logical volume?

   • AUse `blkid` to identify the logical volume's UUID.
   • BUse `lvdisplay` and `vgdisplay` to map the logical volume to its physical extents.
   • CUse `mount` to find the device path of the logical volume.
   • DUse `fdisk -l` to list the logical volume as a partition.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A forensic examiner is trying to recover a deleted file from an NTFS volume. The file was large and stored in multiple fragments. The examiner has located the file's MFT entry, but the data runs are partially overwritten. Which technique is most likely to recover the file?

   • AUse the $Bitmap to identify which clusters were allocated to the file.
   • BUse the MFT entry's data runs to read the clusters, even if some are overwritten.
   • CUse the $LogFile to reconstruct the file's data runs from journal records.
   • DUse file carving to recover fragments and then reassemble them based on content.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic examiner receives a USB drive from a Windows 10 workstation. The drive is formatted with a single partition and the examiner needs to recover a deleted file that was stored in a folder named 'Projects'. The examiner mounts the drive read-only in a Linux forensic workstation and runs `fls -f ntfs -o 2048 /dev/sdb`. The output shows the MFT entries but the deleted file's name is not listed. Which step should the examiner take next to locate the deleted file's data?

   • ARun `icat -f ntfs -o 2048 /dev/sdb` with the MFT entry number of the parent directory.
   • BRun `mmls /dev/sdb` to verify the partition offset and then rerun `fls` without the `-o` option.
   • CRun `fls -f ntfs -o 2048 -d /dev/sdb` to list deleted entries.
   • DRun `fsstat -f ntfs -o 2048 /dev/sdb` to check if the filesystem is NTFS and then use `fls` again.
   Reveal Solution Discussion Select an answer first
5. 29expert · easy

   A forensic examiner is analyzing a filesystem with a block size of 4 KB. A file is 10 KB in size. The examiner needs to determine how many blocks the file occupies, assuming no compression or sparse allocation. Which answer is correct?

   • AThe file occupies 2.5 blocks, because the last block is partially used.
   • BThe file occupies 4 blocks, because the filesystem rounds up to the next power of two.
   • CThe file occupies 3 blocks, because 10 KB divided by 4 KB is 2.5, rounded up to 3.
   • DThe file occupies 2 blocks, because 10 KB is less than 12 KB.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A forensic examiner is analyzing a Linux system that uses ext4 with the default journaling mode. The system crashed, and after reboot, the filesystem was mounted. The examiner needs to determine whether the journal contains any data that could be used to recover recently created files. Which factor is most important?

   • AThe presence of an external journal device determines whether data is recoverable.
   • BThe filesystem was mounted read-only after the crash, so the journal was not replayed.
   • CThe journaling mode (ordered, writeback, or data) determines whether file data is logged in the journal.
   • DThe size of the journal determines how much data can be recovered.
   Reveal Solution Discussion Select an answer first