GIAC Exam GASF Topic 4 Question 44 Discussion

Actual exam question for GIAC's GASF exam

Question #: 44
Topic #: 4

[All GASF Questions]

How would an examiner review items deleted from a SQLITE database?

AUsing a Hex Viewer

BConverting the database to a txt file

CReviewing the file header

DSelecting the raw data from the table

Show Suggested Answer

Suggested Answer: C

by Nguyet at Oct 21, 2024, 12:00 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Roselle

1 months ago

Selecting the raw data? Sounds like a recipe for a good old-fashioned SQL injection attack to me. Just be careful out there, folks!

upvoted 0 times

Aliza

2 days ago

D) Selecting the raw data from the table

upvoted 0 times

...

Velda

7 days ago

C) Reviewing the file header

upvoted 0 times

...

Irene

9 days ago

A) Using a Hex Viewer

upvoted 0 times

...

Mitzie

2 months ago

You know, I've heard that the file header can hold all sorts of hidden secrets. Option C might be the way to go for a real forensic-style investigation.

upvoted 0 times

Teresita

7 days ago

Selecting the raw data from the table might also provide valuable insights.

upvoted 0 times

...

Georgiana

9 days ago

I think using a Hex Viewer could also be helpful in uncovering deleted items.

upvoted 0 times

...

Stevie

15 days ago

I agree, the file header can reveal a lot of information.

upvoted 0 times

...

Joye

2 months ago

Wait, converting the database to a text file? That's a bit like throwing the baby out with the bathwater, don't you think? I'd stick with the original database format if I were you.

upvoted 0 times

...

Layla

2 months ago

Hmm, I'm not sure about that. A hex viewer might be able to dig up some juicy deleted data that's not visible normally. Option A looks promising!

upvoted 0 times

Marcos

1 months ago

Selecting the raw data from the table is another option to consider.

upvoted 0 times

...

Arlene

2 months ago

Reviewing the file header could reveal some deleted items.

upvoted 0 times

...

Dierdre

2 months ago

Converting the database to a txt file might work too.

upvoted 0 times

...

Bette

2 months ago

I think using a Hex Viewer is a good idea.

upvoted 0 times

...

Christa

2 months ago

I'm going to go with option D. Selecting the raw data from the table seems like the most straightforward way to review deleted items in a SQLite database.

upvoted 0 times