Storage Technologies GBFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is analyzing a USB flash drive that appears to have been formatted with the FAT32 file system. The examiner needs to recover deleted files. Which aspect of FAT32 is most important for this task?

   • AThe File Allocation Table contains entries for clusters that may still point to deleted file data.
   • BThe Master File Table (MFT) records the location of every file, including deleted ones.
   • CThe superblock stores a backup of the file system metadata that can be used for recovery.
   • DThe journal contains a log of all file operations, allowing undo of deletions.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic team is preparing to acquire data from a variety of storage devices found at a crime scene, including an older IDE/PATA HDD, a SATA SSD, and a USB flash drive. The team has a forensic workstation with limited ports. Which consideration is most important when selecting acquisition hardware?

   • AUse a single universal write-blocker that connects via USB and supports all interfaces automatically.
   • BEnsure the write-blocker supports each interface (IDE, SATA, USB) and that the workstation has compatible ports or adapters.
   • CPrioritize acquiring the SATA SSD first because it is the most modern and likely to contain the most evidence.
   • DConnect each drive directly to the workstation's motherboard SATA ports and use software write-blocking.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic examiner is analyzing a disk image from a Linux system that uses ext4. The examiner needs to recover a deleted file that was stored in a directory. The inode for the file has been reallocated to another file. Which approach is most likely to recover the file's data?

   • AUse the ext4 journal to recover the file's data blocks, as the journal contains a copy of all file data.
   • BSearch the unallocated space for the file's content using file carving techniques.
   • CCheck the superblock for a backup of the file's data block pointers.
   • DLook at the directory entry to find the old inode number and use it to locate the data blocks.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a forensic examination of a hard drive, an examiner finds that a file's data is scattered across multiple non-contiguous clusters. Which layer of the storage hierarchy is directly responsible for tracking this fragmentation?

   • AThe device driver, which translates logical block addresses to physical sectors.
   • BThe file system's metadata structures, such as the MFT or inode tables.
   • CThe firmware of the hard drive, which manages the physical layout of sectors.
   • DThe partition table, which defines the boundaries of the volume.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An examiner must acquire a solid-state drive (SSD) from a suspect's laptop. The SSD supports the TRIM command and the laptop has been used normally for several weeks. Which consideration is most important for the acquisition strategy?

   • AThe examiner should use a software write-blocker because hardware write-blockers are not compatible with SSDs.
   • BThe SSD must be imaged using a hardware write-blocker to prevent any writes, but this is the only special consideration.
   • CThe SSD's garbage collection may have permanently erased deleted data, so the examiner should not expect to recover all deleted files.
   • DThe SSD should be imaged immediately after power-on to avoid the controller's wear-leveling algorithm moving data.
   Reveal Solution Discussion Select an answer first