CCE File Systems & Data Recovery 2 — Questions and Answers
Question 1: In NTFS, what structure stores the metadata for every file and directory on the volume?
- Volume Boot Record
- Master File Table (Correct answer)
- File Allocation Table
- Partition Table
Correct answer: Master File Table
The Master File Table (MFT) in NTFS contains at least one record for every file and directory, storing metadata such as timestamps, permissions, and data locations.
Question 2: When a file is deleted on an NTFS volume, what typically happens to the MFT record?
- It is immediately overwritten with zeros
- The record is marked as available but the data remains (Correct answer)
- The file is moved to a quarantine zone
- The MFT record is encrypted
Correct answer: The record is marked as available but the data remains
Deleting a file in NTFS marks the MFT record as unallocated, but the actual file data and the record itself persist until the space is reused.
Question 3: Which FAT32 structure contains a 4-byte value indicating whether a cluster is in use, free, or the end of a chain?
- Directory Entry
- Boot Sector
- File Allocation Table (Correct answer)
- Root Directory
Correct answer: File Allocation Table
The File Allocation Table itself holds a 28-bit entry (in a 32-bit field) per cluster that indicates its status: free (0x00000000), end-of-chain (0x0FFFFFFF), or the next cluster in the chain.
Question 4: What is the maximum volume size supported by FAT32?
- 2 GB
- 4 GB
- 2 TB (Correct answer)
- 8 TB
Correct answer: 2 TB
FAT32 supports volumes up to 2 TB when using 512-byte sectors, though Windows format tools artificially limit it to 32 GB.
Question 5: In ext4 forensics, what data structure plays a role analogous to the NTFS MFT record?
- Superblock
- Inode (Correct answer)
- Journal
- Block Group Descriptor
Correct answer: Inode
An inode in ext4 stores file metadata (permissions, timestamps, size, and block pointers) for each file or directory, similar to an MFT record in NTFS.
Question 6: Which NTFS attribute type stores the actual file content when the file is small enough to fit within the MFT record itself?
- $FILE_NAME
- $DATA (resident) (Correct answer)
- $BITMAP
- $STANDARD_INFORMATION
Correct answer: $DATA (resident)
When file data is small enough, NTFS stores it as a resident $DATA attribute directly within the MFT record, eliminating the need for separate cluster allocation.
Question 7: A forensic examiner finds a file with a logical size of 1 byte but a physical size of 4,096 bytes on an NTFS volume. What best explains this difference?
- The file is compressed
- Cluster slack space (Correct answer)
- The file is encrypted
- The MFT record is corrupt
Correct answer: Cluster slack space
Cluster slack (file slack) is the unused space between the logical end of file data and the end of the last allocated cluster, which may contain remnants of previously stored data.
CCE File Systems & Data Recovery 2
In NTFS, what structure stores the metadata for every file and directory on the volume?