File Systems & Data Recovery Flashcards

Which file system is commonly used by Windows operating systems?

Answer: NTFS

NTFS (New Technology File System) is the default and most commonly used file system for Microsoft Windows operating systems. It offers advanced features compared to older file systems, including improved security, journaling for data integrity, support for large files and volumes, and robust data recovery capabilities.

What is the function of the Master File Table (MFT) in NTFS?

Answer: Contains file system metadata

The Master File Table (MFT) is a core component of the NTFS file system, acting as a database that stores critical metadata about every file and directory on the volume. This metadata includes file names, sizes, timestamps, security attributes, and the physical location of the data on the disk, making it essential for file system organization.

Which file system supports journaling and is used on macOS?

Answer: APFS

APFS (Apple File System) is the modern, default file system for macOS, iOS, and other Apple operating systems, designed specifically for flash and solid-state drives. It supports advanced features like strong encryption, space sharing, snapshots, and journaling, which significantly enhance data integrity and overall system reliability.

What is slack space in data recovery?

Answer: Unused space that may hold deleted data

Slack space refers to the unused portion of the last allocated cluster on a disk that a file occupies. This space, though not part of the active file, can often contain remnants of previously deleted files or other data, making it a valuable source for forensic recovery and uncovering hidden information.

Which method is most commonly used to recover deleted files?

Answer: File carving

File carving is a powerful data recovery technique used to extract files from raw disk images or unallocated space without relying on the file system's metadata. It works by searching for known file headers and footers (signatures) to reconstruct files, making it highly effective for recovering deleted, corrupted, or fragmented data.

What is the main purpose of journaling in a file system?

Answer: Maintains file system integrity

The main purpose of journaling in a file system is to maintain file system integrity, especially after unexpected system crashes or power failures. By logging changes to be made to the file system in a separate journal before committing them, the system can quickly recover to a consistent state, preventing data corruption and ensuring reliability.