What is the primary purpose of journaling in file systems like ext4 and XFS?

To compress file data to save disk space

To record changes before they are committed to the main file system, enabling recovery after a crash

To maintain a log of file access times

A server has a separate /home partition. During an investigation, you need to determine if any user data was accessed during the incident. Which approach would provide the most useful evidence?

Review the system authentication logs for successful logins

Check the atime of files in /home

Use the ext4 journal to reconstruct file access events

Examine the shell history files in each user's home directory

You are investigating a file that was deleted from an ext4 filesystem. You have a forensic image, but the file's inode has been reallocated to a new file. What is the most likely outcome of attempting to recover the deleted file?

The file is unrecoverable because the inode is gone

The file can be recovered by using the ext4 journal to restore the inode

The file can be recovered by examining the directory entry

The file content may still be recoverable if the data blocks have not been overwritten

GIAC Linux Incident Responder

Domain 1Objective 4

Linux File System Artifacts GLIR Practice Questions (Page 5)

Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

6concepts

Questions 21–25

21application · medium
You need to determine if the system was rebooted during the incident. Which log file would you examine?
Select an answer first
22foundation · easy
What is the primary purpose of journaling in file systems like ext4 and XFS?
Select an answer first
23application · medium
A server has a separate /home partition. During an investigation, you need to determine if any user data was accessed during the incident. Which approach would provide the most useful evidence?
Select an answer first
24foundation · easy
You are analyzing a compromised Linux system and need to find temporary files that an attacker may have used to stage malicious payloads. Which directory is the standard system-wide location for temporary files?
Select an answer first
25expert · hard
You are investigating a file that was deleted from an ext4 filesystem. You have a forensic image, but the file's inode has been reallocated to a new file. What is the most likely outcome of attempting to recover the deleted file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux File System Artifacts GLIR Practice Questions (Page 5)

Questions 21–25

You need to determine if the system was rebooted during the incident. Which log file would you examine?

What is the primary purpose of journaling in file systems like ext4 and XFS?

A server has a separate /home partition. During an investigation, you need to determine if any user data was accessed during the incident. Which approach would provide the most useful evidence?

You are analyzing a compromised Linux system and need to find temporary files that an attacker may have used to stage malicious payloads. Which directory is the standard system-wide location for temporary files?

You are investigating a file that was deleted from an ext4 filesystem. You have a forensic image, but the file's inode has been reallocated to a new file. What is the most likely outcome of attempting to recover the deleted file?

Keep studying — Linux Fundamentals and File System Analysis