nerdexam
CompTIA

SY0-501 · Question #390

A forensic investigator has run into difficulty recovering usable files from a SAN drive. Which of the following SAN features might have caused the problem?

The correct answer is B. Deduplication. Deduplication makes forensic recovery difficult because it replaces duplicate data blocks with pointers, fragmenting the actual file data across the storage and requiring specialized tools to reconstruct.

Submitted by paula_co· Mar 4, 2026Security operations

Question

A forensic investigator has run into difficulty recovering usable files from a SAN drive. Which of the following SAN features might have caused the problem?

Options

  • AStorage multipaths
  • BDeduplication
  • CiSCSI initiator encryption
  • DData snapshots

How the community answered

(54 responses)
  • A
    7% (4)
  • B
    74% (40)
  • C
    4% (2)
  • D
    15% (8)

Why each option

Deduplication makes forensic recovery difficult because it replaces duplicate data blocks with pointers, fragmenting the actual file data across the storage and requiring specialized tools to reconstruct.

AStorage multipaths

Storage multipaths provide redundant connections to storage, improving availability and performance, but they do not alter how data blocks are stored on the disk itself to prevent recovery.

BDeduplicationCorrect

Deduplication works by identifying and storing only unique blocks of data, replacing duplicate blocks with pointers to the single stored instance. A forensic investigator trying to recover files directly from raw blocks would find most of the file's data replaced by these pointers, making reconstruction of usable files extremely challenging without the deduplication metadata and logic.

CiSCSI initiator encryption

iSCSI initiator encryption encrypts data in transit between the initiator and target, but it doesn't fundamentally change the block storage structure on the SAN in a way that prevents recovery of the underlying encrypted data blocks.

DData snapshots

Data snapshots preserve point-in-time versions of data, which might even aid forensic recovery by providing access to older states, rather than hindering the recovery of usable files.

Concept tested: Data deduplication impact on forensic recovery

Source: https://learn.microsoft.com/en-us/windows-server/storage/data-deduplication/overview

Topics

#SAN#deduplication#digital forensics#data recovery

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice