A forensic examiner is analyzing a disk image from a Windows system that has both NTFS and FAT32 partitions. The examiner needs to recover a deleted file from the FAT32 partition. The file's directory entry has been cleared, but the file's data clusters are still intact. Which approach is most likely to recover the file?

Look at the FAT32 boot sector to find the file's starting cluster and follow the FAT chain.

Scan the FAT32 partition for the file's signature and carve the data from unallocated space.

Check the NTFS journal for a record of the FAT32 file's deletion.

Use the NTFS MFT to locate the file's data runs, as NTFS and FAT32 share the same cluster structure.

A forensic examiner is analyzing a disk image that contains multiple partitions. The first partition is formatted as NTFS, the second as FAT32, and the third as ext4. The examiner needs to recover a file from the NTFS partition. Which tool or method is most appropriate?

Use a tool that only supports FAT32, as NTFS is a variant of FAT.

Manually parse the partition boot sector and follow the file allocation table to locate the file.

Use a tool that supports ext4, as all Linux file systems can read NTFS.

Use a forensic tool that can parse NTFS and mount the partition read-only to extract the file.

An examiner needs to acquire data from an older desktop computer that has an IDE hard drive. The forensic workstation only has SATA ports and a USB 3.0 port. Which combination of tools and procedures is most appropriate?

Use an IDE-to-USB adapter with a hardware write-blocker, then image the drive via USB.

Remove the drive and use a USB docking station without a write-blocker.

Boot the workstation from a forensic CD and use a software write-blocker to image the drive over the network.

Connect the IDE drive directly to the SATA port using a simple cable adapter.

Which of the following correctly represents the storage hierarchy from the smallest to the largest logical unit?

Cluster → Sector → File → Partition

Sector → Cluster → File → Partition

File → Cluster → Sector → Partition

Partition → File → Cluster → Sector

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 4

Storage Technologies GBFA Practice Questions (Page 5)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 21–25

21expert · hard
A forensic examiner is analyzing a disk image from a Windows system that has both NTFS and FAT32 partitions. The examiner needs to recover a deleted file from the FAT32 partition. The file's directory entry has been cleared, but the file's data clusters are still intact. Which approach is most likely to recover the file?
Select an answer first
22foundation · easy
Which file system is the default for modern Windows operating systems and supports features such as access control lists (ACLs), encryption, and journaling?
Select an answer first
23application · easy
A forensic examiner is analyzing a disk image that contains multiple partitions. The first partition is formatted as NTFS, the second as FAT32, and the third as ext4. The examiner needs to recover a file from the NTFS partition. Which tool or method is most appropriate?
Select an answer first
24application · medium
An examiner needs to acquire data from an older desktop computer that has an IDE hard drive. The forensic workstation only has SATA ports and a USB 3.0 port. Which combination of tools and procedures is most appropriate?
Select an answer first
25foundation · easy
Which of the following correctly represents the storage hierarchy from the smallest to the largest logical unit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Storage Technologies GBFA Practice Questions (Page 5)

Questions 21–25

Which file system is the default for modern Windows operating systems and supports features such as access control lists (ACLs), encryption, and journaling?

A forensic examiner is analyzing a disk image that contains multiple partitions. The first partition is formatted as NTFS, the second as FAT32, and the third as ext4. The examiner needs to recover a file from the NTFS partition. Which tool or method is most appropriate?

An examiner needs to acquire data from an older desktop computer that has an IDE hard drive. The forensic workstation only has SATA ports and a USB 3.0 port. Which combination of tools and procedures is most appropriate?

Which of the following correctly represents the storage hierarchy from the smallest to the largest logical unit?

Keep studying — Foundations and Preparation