Manually Finding Data GBFA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of data carving in digital forensics?

   • ATo create a bit-for-bit copy of a hard drive
   • BTo analyze file system metadata
   • CTo search for keywords in allocated files
   • DTo recover files from unallocated space based on file signatures
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   While manually reviewing a forensic image of a Windows system, you find a PDF document that appears to contain sensitive data. You need to determine if the document was originally created on this system or was received from an external source. Which metadata examination would be most helpful?

   • ACheck the file's access time to see when it was last opened.
   • BSearch the unallocated space for fragments of the PDF to see if it was deleted and recovered.
   • CExamine the document's metadata for the author name, creation date, and the software used to create it.
   • DLook at the file's size and compare it to other PDFs on the system.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You are manually searching a Linux image for evidence of a user communicating with a known malicious IP address. Which manual search technique is most efficient?

   • ACarve all deleted files from unallocated space and search for the IP in the carved data.
   • BNavigate to the /var/log directory and manually read each log file.
   • CUse a string search tool to search for the IP address in all files, including logs and configuration files.
   • DExamine the user's bash history to see if they typed the IP address.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   You are examining a document file on a forensic image and need to determine if it was printed. Which metadata or artifact would provide this information?

   • ACheck the file's metadata for a 'Last Printed' property, if present.
   • BLook for the file in the user's Recent Files list.
   • CExamine the file's access time to see if it was opened recently.
   • DSearch for the file name in the system's print spooler logs.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   You are manually examining a forensic image and need to recover a deleted JPEG image from unallocated space. The file system is NTFS and the image may be fragmented. You have a hex editor and a carving tool that supports JPEG carving. Which manual approach is most likely to succeed?

   • AUse the file system's journal to recover the file's original clusters.
   • BSearch the unallocated space for the filename and then copy the surrounding bytes.
   • CUse the carving tool to search for JPEG headers (FF D8 FF) and footers (FF D9), then manually reassemble fragments if the tool fails.
   • DManually search for the JPEG header and then copy everything until the end of the unallocated space.
   Reveal Solution Discussion Select an answer first