You are attempting to recover a deleted file that was non-resident. The MFT record is intact and shows the file's data runs, but the clusters appear to be allocated to another file in the $Bitmap. What is the most likely reason the clusters are marked allocated?

The clusters were reused by another file after deletion, overwriting the original data.

The $Bitmap is corrupted and incorrectly shows the clusters as allocated.

The file was compressed, and compression causes clusters to remain allocated.

The file was encrypted, and encryption causes clusters to remain allocated.

How can the $Bitmap be used in data recovery?

To identify which clusters are unallocated and may contain deleted file data

To reconstruct the content of deleted files

To recover file names from the MFT

Which technique is commonly used to recover deleted files on NTFS?

Using the $Bitmap to reconstruct file content

Carving data from unallocated space using file signatures

Copying from the $Extend directory

GIAC Certified Forensic Analyst

Domain 3Objective 3

NTFS Artifact Analysis GCFA Practice Questions (Page 12)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

16concepts

Questions 56–58

56application · medium
You are attempting to recover a deleted file that was non-resident. The MFT record is intact and shows the file's data runs, but the clusters appear to be allocated to another file in the $Bitmap. What is the most likely reason the clusters are marked allocated?
Select an answer first
57foundation · easy
How can the $Bitmap be used in data recovery?
Select an answer first
58foundation · easy
Which technique is commonly used to recover deleted files on NTFS?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

NTFS Artifact Analysis GCFA Practice Questions (Page 12)

Questions 56–58

You are attempting to recover a deleted file that was non-resident. The MFT record is intact and shows the file's data runs, but the clusters appear to be allocated to another file in the $Bitmap. What is the most likely reason the clusters are marked allocated?

How can the $Bitmap be used in data recovery?

Which technique is commonly used to recover deleted files on NTFS?

Keep studying — File System Forensics