During an investigation, you discover that a critical file was deleted from an ext4 filesystem. The system has been running continuously since the deletion, and you have a forensic image. However, the image was taken after the system had been in use for several hours. Which factor most significantly affects the likelihood of recovering the deleted file?

The number of files created after the deletion

The time elapsed since deletion

The amount of free space on the filesystem

In Linux, the 'change time' (ctime) of a file is updated when which of the following occurs?

The file is moved to a different filesystem

The file's metadata is changed, such as permissions or ownership

You are analyzing a file that was created by an attacker. The file's mtime is set to a date before the incident, but the ctime is after the incident. What does this indicate?

The file was created before the incident and only read during the incident

The file was copied from another system, preserving the original mtime

The file's permissions were changed, which updated the ctime but not the mtime

The attacker used a tool like touch to set the mtime to an earlier time, but the ctime reflects the actual modification time

GIAC Linux Incident Responder

Domain 1Objective 4

Linux File System Artifacts GLIR Practice Questions (Page 4)

Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

6concepts

Questions 16–20

16expert · hard
During an investigation, you discover that a critical file was deleted from an ext4 filesystem. The system has been running continuously since the deletion, and you have a forensic image. However, the image was taken after the system had been in use for several hours. Which factor most significantly affects the likelihood of recovering the deleted file?
Select an answer first
17foundation · easy
In Linux, the 'change time' (ctime) of a file is updated when which of the following occurs?
Select an answer first
18application · medium
You are investigating a system that uses XFS filesystem. You need to understand how file changes are recorded to determine if any data was lost during a crash. Which feature of XFS is most relevant?
Select an answer first
19application · medium
You are analyzing a file that was created by an attacker. The file's mtime is set to a date before the incident, but the ctime is after the incident. What does this indicate?
Select an answer first
20foundation · easy
During an incident response, you need to locate system-wide configuration files that define how services start and what network ports they listen on. Which standard Linux directory is the primary location for such configuration files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux File System Artifacts GLIR Practice Questions (Page 4)

Questions 16–20

In Linux, the 'change time' (ctime) of a file is updated when which of the following occurs?

You are investigating a system that uses XFS filesystem. You need to understand how file changes are recorded to determine if any data was lost during a crash. Which feature of XFS is most relevant?

You are analyzing a file that was created by an attacker. The file's mtime is set to a date before the incident, but the ctime is after the incident. What does this indicate?

During an incident response, you need to locate system-wide configuration files that define how services start and what network ports they listen on. Which standard Linux directory is the primary location for such configuration files?

Keep studying — Linux Fundamentals and File System Analysis