CHFI OS and File System Forensics Practice Question
Exhibit
Refer to the exhibit. === Linux log excerpt (var/log/syslog) === Jan 12 10:15:32 server1 kernel: [ 1234.5678] EXT4-fs (sda1): recovery complete Jan 12 10:15:33 server1 kernel: [ 1234.5680] EXT4-fs (sda1): mounted filesystem with ordered data mode. Opts: (null) Jan 12 10:15:34 server1 sshd[2345]: Accepted publickey for root from 192.168.1.10 port 54321 ssh2: RSA SHA256:abc... Jan 12 10:15:35 server1 sshd[2346]: Received disconnect from 192.168.1.10 port 54321:11: disconnected by user Jan 12 10:15:36 server1 kernel: [ 1234.5700] EXT4-fs (sda1): 1 orphan inode deleted Jan 12 10:15:37 server1 kernel: [ 1234.5702] EXT4-fs (sda1): 1 orphan inode deleted
A forensic analyst is reviewing the syslog from a compromised Linux server. Based on the exhibit, what does the 'orphan inode deleted' message indicate?
⚠ Common exam trap
EC-Council often tests the misconception that 'orphan inode deleted' is a security alert or sign of malicious activity, when in fact it is a normal filesystem housekeeping message that occurs whenever a file is deleted while still open by a process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A file was deleted while still open, and the filesystem has cleaned up the orphan inode.
The 'orphan inode deleted' message in syslog indicates that a file was deleted while it was still open by a process. The kernel's inode cleanup mechanism (part of the VFS layer) detected the orphaned inode—an inode with no directory entry but still referenced by an open file descriptor—and removed it after the last file descriptor was closed. This is standard behavior in Linux filesystems (e.g., ext4) and is not indicative of hidden files, rootkits, or critical system file alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A hidden file was permanently removed from the filesystem.
Why it's wrong here
The syslog message describes a deleted orphan inode, not a hidden file. An orphan inode is an inode whose directory entry was removed while it was still open by a process, and the filesystem performs cleanup on the next mount. Hidden files are ordinary directory entries beginning with a dot, and the kernel message does not reference any filename or dotfile state. Thus the message indicates a normal unlink-while-open event, not the permanent removal of a hidden file.
- ✓
A file was deleted while still open, and the filesystem has cleaned up the orphan inode.
Why this is correct
When a file is unlinked but a process still holds its file descriptor, the inode remains allocated until the descriptor closes, resulting in an orphan inode. On a journaling filesystem such as ext4, that inode is recorded in the orphan list during the transaction, and after an unclean shutdown or during mount, the filesystem deletes it to reclaim space and logs 'orphan inode' messages. This is expected lifecycle behavior, not a sign of an attack or corruption.
- ✗
A rootkit has attempted to hide files by marking them as orphan inodes.
Why it's wrong here
The orphan inode message is generated by the kernel's filesystem layer during mount/recovery and refers to inodes that were open at the time of an unlink. Rootkits typically hide files by intercepting system calls or manipulating directory entries; they do not 'mark' inodes as orphaned, because an orphan inode is not a hidden file but one that has already lost its directory entry. Userspace processes cannot set an inode's orphan state, and this log line contains no evidence of rootkit activity.
- ✗
A critical system file has been deleted, and the filesystem is warning the administrator.
Why it's wrong here
The log message does not identify any particular file or inode, and it is an informational cleanup notice, not a system warning. A 'critical system file' is an administrative classification that the filesystem never evaluates; orphan inode cleanup applies equally to any open-but-unlinked file, such as a temporary database file or a rotated log. Even if a critical file were deleted, this message would not indicate which one or whether the loss was intentional.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.