GIAC GASF Exam - Topic 4 Question 44 Discussion

Actual exam question for GIAC's GASF exam

Question #: 44
Topic #: 4

[All GASF Questions]

How would an examiner review items deleted from a SQLITE database?

AUsing a Hex Viewer

BConverting the database to a txt file

CReviewing the file header

DSelecting the raw data from the table

Show Suggested Answer

Suggested Answer: C

by Nguyet at Oct 21, 2024, 12:00 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Elliott

8 months ago

Wait, can you really recover deleted items like that?

upvoted 0 times

...

Linsey

9 months ago

I agree, raw data selection seems more straightforward.

upvoted 0 times

...

Jonelle

9 months ago

Reviewing the file header? Sounds a bit off to me.

upvoted 0 times

...

Loreta

9 months ago

I think converting to a txt file could work too.

upvoted 0 times

...

Rene

9 months ago

A Hex Viewer is definitely one way to go!

upvoted 0 times

...

Scarlet

9 months ago

Selecting raw data from the table seems like it could work, but I feel like that only applies to current entries, not deleted ones.

upvoted 0 times

...

An

10 months ago

Reviewing the file header sounds familiar, but I can't recall if that actually shows deleted items or just metadata.

upvoted 0 times

...

Freeman

10 months ago

I remember practicing a question about converting databases to text files, but I don't think that would help with deleted records.

upvoted 0 times

...

Orville

10 months ago

I think using a Hex Viewer might be the right approach, but I'm not entirely sure how that works with deleted items.

upvoted 0 times

...

Levi

10 months ago

This looks straightforward. I'm confident I can apply my knowledge of SQLite to solve this question.

upvoted 0 times

...

Simona

10 months ago

Okay, I've got a strategy in mind. I'll start by considering the different options and then justify my choice.

upvoted 0 times

...

Linn

10 months ago

I think the key here is understanding how SQLite handles deleted data. I'll focus on that in my answer.

upvoted 0 times

...

Leonida

10 months ago

Hmm, I'm not entirely sure how to approach this. I'll need to review my notes on SQLite database structure.

upvoted 0 times

...

Glenna

10 months ago

This seems like a tricky one. I'll need to think carefully about the best approach.

upvoted 0 times

...

Roselle

1 year ago

Selecting the raw data? Sounds like a recipe for a good old-fashioned SQL injection attack to me. Just be careful out there, folks!

upvoted 0 times

Aliza

1 year ago

D) Selecting the raw data from the table

upvoted 0 times

...

Velda

1 year ago

C) Reviewing the file header

upvoted 0 times

...

Irene

1 year ago

A) Using a Hex Viewer

upvoted 0 times

...

Mitzie

1 year ago

You know, I've heard that the file header can hold all sorts of hidden secrets. Option C might be the way to go for a real forensic-style investigation.

upvoted 0 times

Teresita

1 year ago

Selecting the raw data from the table might also provide valuable insights.

upvoted 0 times

...

Georgiana

1 year ago

I think using a Hex Viewer could also be helpful in uncovering deleted items.

upvoted 0 times

...

Stevie

1 year ago

I agree, the file header can reveal a lot of information.

upvoted 0 times

...

Joye

1 year ago

Wait, converting the database to a text file? That's a bit like throwing the baby out with the bathwater, don't you think? I'd stick with the original database format if I were you.

upvoted 0 times

...

Layla

1 year ago

Hmm, I'm not sure about that. A hex viewer might be able to dig up some juicy deleted data that's not visible normally. Option A looks promising!

upvoted 0 times

Marcos

1 year ago

Selecting the raw data from the table is another option to consider.

upvoted 0 times

...

Arlene

1 year ago

Reviewing the file header could reveal some deleted items.

upvoted 0 times

...

Dierdre

1 year ago

Converting the database to a txt file might work too.

upvoted 0 times

...

Bette

1 year ago

I think using a Hex Viewer is a good idea.

upvoted 0 times

...

Christa

1 year ago

I'm going to go with option D. Selecting the raw data from the table seems like the most straightforward way to review deleted items in a SQLite database.

upvoted 0 times