Filesystem Fundamentals GBFA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of journaling in a filesystem like ext4 or NTFS?

   • ATo maintain a log of changes to prevent corruption after a crash
   • BTo compress data on disk
   • CTo encrypt file contents
   • DTo increase the maximum file size
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A forensic examiner is analyzing a file system that uses indexed allocation. The examiner finds a file's inode and wants to understand how the file's data blocks are located. Which description best matches indexed allocation?

   • AEach file is stored in contiguous blocks, and the inode records only the starting block and length.
   • BThe file's data is stored in a single contiguous extent, and the inode stores the extent's location.
   • CEach data block contains a pointer to the next block in the file, forming a linked list.
   • DThe inode contains a list of block pointers, possibly with indirect blocks for large files.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During a forensic examination of an NTFS volume, an analyst finds that a file's MFT entry has been marked as deleted, but the file's data runs are still intact. Which condition is necessary for the file to be recoverable?

   • AThe file was encrypted with EFS.
   • BThe file was stored in the MFT itself as a resident attribute.
   • CThe volume has a system restore point that includes the file.
   • DThe MFT entry has not been reused by another file, and the clusters referenced by the data runs have not been reallocated.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In filesystem operations, what is the typical size of a sector on a traditional hard disk drive?

   • A512 bytes
   • B64 KB
   • C4096 bytes
   • D1024 bytes
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A forensic analyst is examining a Linux server that experienced a power failure. The root filesystem is ext4 with journaling enabled. After reboot, the system mounts the filesystem and the analyst wants to understand what the journal contains. Which statement accurately describes the role of the journal in this scenario?

   • AThe journal contains a record of metadata changes that can be replayed to bring the filesystem to a consistent state.
   • BThe journal stores a full backup of all file data, allowing complete recovery of any lost files.
   • CThe journal is cleared on every clean unmount, so it is empty after a power failure.
   • DThe journal is used only to speed up file access by caching frequently used inodes.
   Reveal Solution Discussion Select an answer first