CCE File Systems & Data Recovery 2

Question 1

In NTFS, what structure stores the metadata for every file and directory on the volume?

Accepted Answer

Master File Table

Answer

The Master File Table (MFT) in NTFS contains at least one record for every file and directory, storing metadata such as timestamps, permissions, and data locations.

Question 2

When a file is deleted on an NTFS volume, what typically happens to the MFT record?

Accepted Answer

The record is marked as available but the data remains

Answer

Deleting a file in NTFS marks the MFT record as unallocated, but the actual file data and the record itself persist until the space is reused.

Question 3

Which FAT32 structure contains a 4-byte value indicating whether a cluster is in use, free, or the end of a chain?

Accepted Answer

File Allocation Table

Answer

The File Allocation Table itself holds a 28-bit entry (in a 32-bit field) per cluster that indicates its status: free (0x00000000), end-of-chain (0x0FFFFFFF), or the next cluster in the chain.

Question 4

What is the maximum volume size supported by FAT32?

Accepted Answer

2 TB

Answer

FAT32 supports volumes up to 2 TB when using 512-byte sectors, though Windows format tools artificially limit it to 32 GB.

Question 5

In ext4 forensics, what data structure plays a role analogous to the NTFS MFT record?

Accepted Answer

Inode

Answer

An inode in ext4 stores file metadata (permissions, timestamps, size, and block pointers) for each file or directory, similar to an MFT record in NTFS.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE File Systems & Data Recovery 2