In linked file allocation, how is the next block of a file located?

By calculating the next block address from the file's starting block

By consulting a central index table

By reading a pointer stored in the current block

By searching the directory entry for the block list

A forensic examiner is analyzing a disk image from a Linux server that uses LVM with multiple physical volumes. The examiner needs to acquire a logical volume that spans two physical volumes. Which approach is most appropriate to acquire the logical volume?

Use `lvdisplay` to get the LV size and then acquire only that many bytes from the first physical volume.

Acquire each physical volume separately and then reconstruct the logical volume using LVM metadata.

Acquire only the logical volume device node (e.g., /dev/vg/lv) as a single image.

Use `dd` to copy the logical volume to a single file, ignoring the physical volumes.

A forensic examiner is analyzing an NTFS volume and needs to understand how the MFT stores file metadata. Which statement is accurate?

The MFT is a single file that stores all file contents in a contiguous block.

The MFT uses inodes to store file metadata, similar to ext4.

Each file has at least one MFT entry that contains attributes such as filename, timestamps, and data runs.

The MFT is stored in the boot sector of the volume.

A forensic examiner is analyzing an NTFS volume from a system that experienced a power failure. The examiner notices that the `$LogFile` contains records of file operations that were not yet flushed to the MFT. What is the primary purpose of `$LogFile` in NTFS?

To store a backup copy of every file's content for recovery purposes.

To maintain a list of all deleted files for forensic recovery.

To store the master file table's index for faster directory lookups.

To record metadata changes so the filesystem can be rolled back to a consistent state after a crash.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 1

Filesystem Fundamentals GBFA Practice Questions (Page 8)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 36–40

36foundation · easy
In linked file allocation, how is the next block of a file located?
Select an answer first
37expert · hard
A forensic examiner is analyzing a disk image from a Linux server that uses LVM with multiple physical volumes. The examiner needs to acquire a logical volume that spans two physical volumes. Which approach is most appropriate to acquire the logical volume?
Select an answer first
38foundation · easy
In a standard Linux directory tree, which directory contains most of the system's essential executable binaries that are required for booting and basic operation?
Select an answer first
39application · medium
A forensic examiner is analyzing an NTFS volume and needs to understand how the MFT stores file metadata. Which statement is accurate?
Select an answer first
40application · medium
A forensic examiner is analyzing an NTFS volume from a system that experienced a power failure. The examiner notices that the `$LogFile` contains records of file operations that were not yet flushed to the MFT. What is the primary purpose of `$LogFile` in NTFS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.