Which of the following is a primary limitation when attempting to recover deleted files from an ext4 file system?

The file system may have reused the deleted file's data blocks for new data

Deleted files cannot be recovered on journaling file systems

The deleted file's inode is immediately zeroed out, making recovery impossible

The file system journal may have overwritten the deleted file's data blocks

You are analyzing a suspicious script in /tmp. The script's mtime is older than its ctime. What does this indicate?

The script's permissions or ownership were changed after the last content modification

The script's content was modified after its metadata was changed

The script was copied to /tmp, which updated its ctime

The script was accessed after it was last modified

You are investigating a breach on a server that uses XFS for its root filesystem. You need to determine when a specific file was last modified. Which source provides the most reliable timestamp information?

The file's ctime from the inode

The access time from the directory entry

The modification time from the filesystem superblock

GIAC Linux Incident Responder

Domain 1Objective 4

Linux File System Artifacts GLIR Practice Questions (Page 6)

Part of the Linux Fundamentals and File System Analysis domain, which makes up ~35% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~25–42 in this domain), expect 6–11 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

6concepts

Questions 26–30

26foundation · easy
Which of the following is a primary limitation when attempting to recover deleted files from an ext4 file system?
Select an answer first
27application · medium
You are analyzing a suspicious script in /tmp. The script's mtime is older than its ctime. What does this indicate?
Select an answer first
28foundation · easy
Which Linux system log file is the primary location for authentication-related events, such as successful and failed login attempts?
Select an answer first
29foundation · easy
You are investigating a file that was downloaded by an attacker. Which timestamp would be most useful to determine when the file's content was last written to disk?
Select an answer first
30application · medium
You are investigating a breach on a server that uses XFS for its root filesystem. You need to determine when a specific file was last modified. Which source provides the most reliable timestamp information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Linux File System Artifacts GLIR Practice Questions (Page 6)

Questions 26–30

Which of the following is a primary limitation when attempting to recover deleted files from an ext4 file system?

You are analyzing a suspicious script in /tmp. The script's mtime is older than its ctime. What does this indicate?

Which Linux system log file is the primary location for authentication-related events, such as successful and failed login attempts?

You are investigating a file that was downloaded by an attacker. Which timestamp would be most useful to determine when the file's content was last written to disk?

You are investigating a breach on a server that uses XFS for its root filesystem. You need to determine when a specific file was last modified. Which source provides the most reliable timestamp information?

Keep studying — Linux Fundamentals and File System Analysis