SY0-501 · Question #390
A forensic investigator has run into difficulty recovering usable files from a SAN drive. Which of the following SAN features might have caused the problem?
The correct answer is B. Deduplication. Deduplication makes forensic recovery difficult because it replaces duplicate data blocks with pointers, fragmenting the actual file data across the storage and requiring specialized tools to reconstruct.
Question
A forensic investigator has run into difficulty recovering usable files from a SAN drive. Which of the following SAN features might have caused the problem?
Options
- AStorage multipaths
- BDeduplication
- CiSCSI initiator encryption
- DData snapshots
How the community answered
(54 responses)- A7% (4)
- B74% (40)
- C4% (2)
- D15% (8)
Why each option
Deduplication makes forensic recovery difficult because it replaces duplicate data blocks with pointers, fragmenting the actual file data across the storage and requiring specialized tools to reconstruct.
Storage multipaths provide redundant connections to storage, improving availability and performance, but they do not alter how data blocks are stored on the disk itself to prevent recovery.
Deduplication works by identifying and storing only unique blocks of data, replacing duplicate blocks with pointers to the single stored instance. A forensic investigator trying to recover files directly from raw blocks would find most of the file's data replaced by these pointers, making reconstruction of usable files extremely challenging without the deduplication metadata and logic.
iSCSI initiator encryption encrypts data in transit between the initiator and target, but it doesn't fundamentally change the block storage structure on the SAN in a way that prevents recovery of the underlying encrypted data blocks.
Data snapshots preserve point-in-time versions of data, which might even aid forensic recovery by providing access to older states, rather than hindering the recovery of usable files.
Concept tested: Data deduplication impact on forensic recovery
Source: https://learn.microsoft.com/en-us/windows-server/storage/data-deduplication/overview
Topics
Community Discussion
No community discussion yet for this question.