Practice Test Geeks(CCE) Certified Computer Examiner Practice Test
← All CCE Flashcard Decks

File Systems & Data Recovery Flashcards

7 cards from real CCE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 File Systems & Data Recovery flashcards as text

  1. In NTFS, what structure stores the metadata for every file and directory on the volume?

    Answer: Master File Table

    The Master File Table (MFT) in NTFS contains at least one record for every file and directory, storing metadata such as timestamps, permissions, and data locations.

  2. When a file is deleted on an NTFS volume, what typically happens to the MFT record?

    Answer: The record is marked as available but the data remains

    Deleting a file in NTFS marks the MFT record as unallocated, but the actual file data and the record itself persist until the space is reused.

  3. Which FAT32 structure contains a 4-byte value indicating whether a cluster is in use, free, or the end of a chain?

    Answer: File Allocation Table

    The File Allocation Table itself holds a 28-bit entry (in a 32-bit field) per cluster that indicates its status: free (0x00000000), end-of-chain (0x0FFFFFFF), or the next cluster in the chain.

  4. What is the maximum volume size supported by FAT32?

    Answer: 2 TB

    FAT32 supports volumes up to 2 TB when using 512-byte sectors, though Windows format tools artificially limit it to 32 GB.

  5. In ext4 forensics, what data structure plays a role analogous to the NTFS MFT record?

    Answer: Inode

    An inode in ext4 stores file metadata (permissions, timestamps, size, and block pointers) for each file or directory, similar to an MFT record in NTFS.

  6. Which NTFS attribute type stores the actual file content when the file is small enough to fit within the MFT record itself?

    Answer: $DATA (resident)

    When file data is small enough, NTFS stores it as a resident $DATA attribute directly within the MFT record, eliminating the need for separate cluster allocation.

  7. A forensic examiner finds a file with a logical size of 1 byte but a physical size of 4,096 bytes on an NTFS volume. What best explains this difference?

    Answer: Cluster slack space

    Cluster slack (file slack) is the unused space between the logical end of file data and the end of the last allocated cluster, which may contain remnants of previously stored data.