A forensic analyst needs to recover a deleted file from an ext4 filesystem without mounting it. The file's inode number is known to be 12345. Which tool and approach should be used?

debugfs -R 'dump /recovered_file' /dev/sdb1

tune2fs -O ^has_journal /dev/sdb1 and then use dd to copy the raw device

mount -o ro /dev/sdb1 /mnt and then use grep to find the file

fsck -y /dev/sdb1 and then use extundelete

What information can be obtained from the output of dumpe2fs?

The list of users with access to the filesystem

The IP address of the filesystem server

Filesystem state, block count, and reserved blocks

The kernel version used to create the filesystem

LPI LPIC-2:Linux Engineer (201-450)

Domain 4Objective 2

203.2 Maintaining a Linux Filesystem (weight: 3) LPIC-2 Practice Questions (Page 5)

Part of the Topic 203: Filesystem and Devices domain, which makes up ~10% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

13concepts

13 Concepts in This Objective

Filesystem maintenance overview
Checking filesystem integrity with fsck
Understanding filesystem states and dirty flags
Forcing filesystem checks
Using tune2fs to adjust filesystem parameters
Using dumpe2fs to display filesystem information
Using debugfs for interactive filesystem debugging
Checking and repairing XFS filesystems
Checking and repairing btrfs filesystems
Monitoring filesystem health and errors
Managing filesystem journaling
Handling filesystem full and inode exhaustion
Performing filesystem maintenance safely

Questions 21–25

21expert · hard
A forensic analyst needs to recover a deleted file from an ext4 filesystem without mounting it. The file's inode number is known to be 12345. Which tool and approach should be used?
Select an answer first
22application · medium
A server's disk is reporting I/O errors in dmesg. The admin wants to determine if the disk itself is failing or if it's a filesystem issue. Which tool should be used first?
Select an answer first
23foundation · easy
Which command displays detailed superblock information for an ext4 filesystem?
Select an answer first
24foundation · easy
What information can be obtained from the output of dumpe2fs?
Select an answer first
25foundation · easy
Which tool is used to monitor the health of a hard disk drive via S.M.A.R.T.?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-2

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-2” is a trademark of its owner, used for identification only.

203.2 Maintaining a Linux Filesystem (weight: 3) LPIC-2 Practice Questions (Page 5)

Questions 21–25

A forensic analyst needs to recover a deleted file from an ext4 filesystem without mounting it. The file's inode number is known to be 12345. Which tool and approach should be used?

A server's disk is reporting I/O errors in dmesg. The admin wants to determine if the disk itself is failing or if it's a filesystem issue. Which tool should be used first?

Which command displays detailed superblock information for an ext4 filesystem?

What information can be obtained from the output of dumpe2fs?

Which tool is used to monitor the health of a hard disk drive via S.M.A.R.T.?

Keep studying — Topic 203: Filesystem and Devices