Storage Technologies GBFA Practice Questions (Page 9)

Questions 41–43

1. 41expert · hard

   An examiner must acquire a laptop that has a self-encrypting drive (SED) with hardware encryption. The laptop is powered off, and the examiner does not have the user's password. Which acquisition approach is most likely to yield usable evidence?

   • AImage the drive as-is; the encryption is transparent and the image will be readable.
   • BUse a hardware write-blocker and image the drive; the encryption will be bypassed by the write-blocker.
   • CBoot the laptop from a forensic live CD and use software to decrypt the drive.
   • DObtain the user's password or the recovery key, then acquire the drive with the drive unlocked.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During the analysis of a forensic image of an ext4 file system, an examiner needs to recover a file that was recently deleted. The file's inode is still present. Which step is most directly relevant to locating the file's data blocks?

   • ALook at the directory entry to find the file's starting block and then follow the file allocation table.
   • BCheck the superblock for a list of allocated blocks for each file.
   • CSearch the journal for the file's content, as ext4 journals all file data.
   • DExamine the inode's block pointers, which reference the data blocks directly or through indirect blocks.
   Reveal Solution Discussion Select an answer first
3. 43application · medium

   A forensic examiner is asked to acquire a mobile phone's internal storage, which uses eMMC. The phone is powered off. Which acquisition method is most appropriate?

   • AConnect the phone to a forensic workstation via USB and use Android Debug Bridge (ADB) to acquire a logical image.
   • BBoot the phone into recovery mode and use fastboot to acquire the storage.
   • CRemove the eMMC chip from the phone and read it using a chip-off reader.
   • DUse a hardware write-blocker designed for eMMC and connect the phone's storage via a memory card reader.
   Reveal Solution Discussion Select an answer first