GIAC Exam GASF Topic 4 Question 44 Discussion

Actual exam question for GIAC's GASF exam

Question #: 44
Topic #: 4

[All GASF Questions]

How would an examiner review items deleted from a SQLITE database?

AUsing a Hex Viewer

BConverting the database to a txt file

CReviewing the file header

DSelecting the raw data from the table

Show Suggested Answer

Suggested Answer: C

by Nguyet at Oct 21, 2024, 12:00 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Layla

5 days ago

Hmm, I'm not sure about that. A hex viewer might be able to dig up some juicy deleted data that's not visible normally. Option A looks promising!

upvoted 0 times

...

Christa

8 days ago

I'm going to go with option D. Selecting the raw data from the table seems like the most straightforward way to review deleted items in a SQLite database.

upvoted 0 times

...

Effie

16 days ago

I think reviewing the file header could also be a good way to analyze deleted items in the database.

upvoted 0 times

...

Ashley

20 days ago

I agree with Dulce. Using a Hex Viewer can help in recovering deleted items from the database.

upvoted 0 times

...

Dulce

21 days ago

I think an examiner would review items deleted from a SQLITE database by using a Hex Viewer.

upvoted 0 times

...