nerdexam
GIAC

GCFA · Question #168

Which of the following tools is used to restore deleted files from Linux and Mac OS X file system?

The correct answer is A. Easy-Undelete. Easy-Undelete is identified as the file recovery tool capable of restoring deleted files from Linux and Mac OS X file systems.

Advanced Mac & Linux Forensics

Question

Which of the following tools is used to restore deleted files from Linux and Mac OS X file system?

Options

  • AEasy-Undelete
  • BActive@ UNERASER
  • CActive@ UNDELETE
  • DR-Undelete

How the community answered

(45 responses)
  • A
    73% (33)
  • B
    7% (3)
  • C
    4% (2)
  • D
    16% (7)

Why each option

Easy-Undelete is identified as the file recovery tool capable of restoring deleted files from Linux and Mac OS X file systems.

AEasy-UndeleteCorrect

Easy-Undelete supports recovery across multiple file system types including ext2/ext3 used by Linux and HFS+ used by Mac OS X, making it applicable for cross-platform forensic recovery. It scans underlying file system structures to locate file entries marked as deleted but not yet overwritten, then restores their content from the original disk sectors.

BActive@ UNERASER

Active@ UNERASER is primarily designed for FAT and NTFS file systems found on Windows systems and is not the designated tool for Linux or Mac OS X native file system recovery.

CActive@ UNDELETE

Active@ UNDELETE is a Windows-centric recovery application targeting NTFS and FAT partitions and is not designed for recovering files from Linux or Mac OS X file systems.

DR-Undelete

R-Undelete focuses on FAT and NTFS Windows file systems and does not support the native file systems used by Linux or Mac OS X.

Concept tested: Cross-platform deleted file recovery tool selection

Topics

#file recovery#deleted files#Linux forensics#Mac forensics tools

Community Discussion

No community discussion yet for this question.

Full GCFA Practice