A forensic examiner is examining a hard drive that was used in a Windows 10 system. The drive has a single NTFS partition. The examiner needs to find evidence of a file that was deleted from the user's Documents folder. Which NTFS structure is most likely to contain remnants of the deleted file's metadata?

The journal, which logs all file operations.

The Master File Table (MFT), which may retain entries for deleted files.

The File Allocation Table (FAT), which tracks cluster chains.

The superblock, which contains file system metadata.

A forensic examiner is analyzing a disk image from a Linux system that uses ext4. The examiner finds that a file's inode points to a data block that is beyond the end of the partition. What is the most likely explanation?

The file is a sparse file, and the inode points to a hole that is outside the partition.

The file is fragmented, and the inode points to a fragment that is stored in a different partition.

The file system is corrupted, possibly due to improper shutdown or a forensic tool error.

The file is stored in an alternate data stream, which is outside the partition.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 4

Storage Technologies GBFA Practice Questions (Page 4)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 16–20

16application · medium
A forensic examiner is examining a hard drive that was used in a Windows 10 system. The drive has a single NTFS partition. The examiner needs to find evidence of a file that was deleted from the user's Documents folder. Which NTFS structure is most likely to contain remnants of the deleted file's metadata?
Select an answer first
17foundation · easy
In the storage hierarchy, which of the following is the smallest addressable unit on a physical disk?
Select an answer first
18foundation · easy
A forensic examiner needs to connect a legacy hard drive with a 40-pin ribbon cable to a forensic workstation. Which interface does this drive use?
Select an answer first
19foundation · easy
Which imaging method creates a bit-for-bit copy of the entire storage device, including unallocated space and slack space?
Select an answer first
20expert · hard
A forensic examiner is analyzing a disk image from a Linux system that uses ext4. The examiner finds that a file's inode points to a data block that is beyond the end of the partition. What is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Storage Technologies GBFA Practice Questions (Page 4)

Questions 16–20

In the storage hierarchy, which of the following is the smallest addressable unit on a physical disk?

A forensic examiner needs to connect a legacy hard drive with a 40-pin ribbon cable to a forensic workstation. Which interface does this drive use?

Which imaging method creates a bit-for-bit copy of the entire storage device, including unallocated space and slack space?

A forensic examiner is analyzing a disk image from a Linux system that uses ext4. The examiner finds that a file's inode points to a data block that is beyond the end of the partition. What is the most likely explanation?

Keep studying — Foundations and Preparation