GIAC GASF Exam - Topic 4 Question 44 Discussion

Actual exam question for GIAC's GASF exam

Question #: 44
Topic #: 4

[All GASF Questions]

How would an examiner review items deleted from a SQLITE database?

AUsing a Hex Viewer

BConverting the database to a txt file

CReviewing the file header

DSelecting the raw data from the table

Show Suggested Answer

Suggested Answer: C

by Nguyet at Oct 21, 2024, 12:00 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Elliott

3 months ago

Wait, can you really recover deleted items like that?

upvoted 0 times

...

Linsey

3 months ago

I agree, raw data selection seems more straightforward.

upvoted 0 times

...

Jonelle

3 months ago

Reviewing the file header? Sounds a bit off to me.

upvoted 0 times

...

Loreta

4 months ago

I think converting to a txt file could work too.

upvoted 0 times

...

Rene

4 months ago

A Hex Viewer is definitely one way to go!

upvoted 0 times

...

Scarlet

4 months ago

Selecting raw data from the table seems like it could work, but I feel like that only applies to current entries, not deleted ones.

upvoted 0 times

...

An

4 months ago

Reviewing the file header sounds familiar, but I can't recall if that actually shows deleted items or just metadata.

upvoted 0 times

...

Freeman

4 months ago

I remember practicing a question about converting databases to text files, but I don't think that would help with deleted records.

upvoted 0 times

...

Orville

5 months ago

I think using a Hex Viewer might be the right approach, but I'm not entirely sure how that works with deleted items.

upvoted 0 times

...

Levi

5 months ago

This looks straightforward. I'm confident I can apply my knowledge of SQLite to solve this question.

upvoted 0 times

...

Simona

5 months ago

Okay, I've got a strategy in mind. I'll start by considering the different options and then justify my choice.

upvoted 0 times

...

Linn

5 months ago

I think the key here is understanding how SQLite handles deleted data. I'll focus on that in my answer.

upvoted 0 times

...

Leonida

5 months ago

Hmm, I'm not entirely sure how to approach this. I'll need to review my notes on SQLite database structure.

upvoted 0 times

...

Glenna

5 months ago

This seems like a tricky one. I'll need to think carefully about the best approach.

upvoted 0 times

...

Roselle

10 months ago

Selecting the raw data? Sounds like a recipe for a good old-fashioned SQL injection attack to me. Just be careful out there, folks!

upvoted 0 times

Aliza

8 months ago

D) Selecting the raw data from the table

upvoted 0 times

...

Velda

8 months ago

C) Reviewing the file header

upvoted 0 times

...

Irene

8 months ago

A) Using a Hex Viewer

upvoted 0 times

...

Mitzie

10 months ago

You know, I've heard that the file header can hold all sorts of hidden secrets. Option C might be the way to go for a real forensic-style investigation.

upvoted 0 times

Teresita

8 months ago

Selecting the raw data from the table might also provide valuable insights.

upvoted 0 times

...

Georgiana

8 months ago

I think using a Hex Viewer could also be helpful in uncovering deleted items.

upvoted 0 times

...

Stevie

9 months ago

I agree, the file header can reveal a lot of information.

upvoted 0 times

...

Joye

10 months ago

Wait, converting the database to a text file? That's a bit like throwing the baby out with the bathwater, don't you think? I'd stick with the original database format if I were you.

upvoted 0 times

...

Layla

10 months ago

Hmm, I'm not sure about that. A hex viewer might be able to dig up some juicy deleted data that's not visible normally. Option A looks promising!

upvoted 0 times

Marcos

10 months ago

Selecting the raw data from the table is another option to consider.

upvoted 0 times

...

Arlene

10 months ago

Reviewing the file header could reveal some deleted items.

upvoted 0 times

...

Dierdre

10 months ago

Converting the database to a txt file might work too.

upvoted 0 times

...

Bette

10 months ago

I think using a Hex Viewer is a good idea.

upvoted 0 times

...

Christa

10 months ago

I'm going to go with option D. Selecting the raw data from the table seems like the most straightforward way to review deleted items in a SQLite database.

upvoted 0 times