CHFI Storage Forensics and File System Analysis Practice Question
An analyst is recovering deleted files from a FAT32 file system. The file system uses a cluster size of 4096 bytes. The first cluster of a deleted file is cluster 100. Which structure contains the chain of clusters for this file?
⚠ Common exam trap
EC-CHFI often tests the misconception that the directory entry stores the entire cluster chain, when in fact it only stores the starting cluster number, and the FAT holds the linked list of subsequent clusters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File Allocation Table (FAT)
The File Allocation Table (FAT) is the core structure that stores the chain of clusters for files in FAT32 file systems. When a file is deleted, its directory entry is marked as available, but the FAT entries for its clusters (starting at cluster 100) remain intact until overwritten, allowing recovery by following the cluster chain in the FAT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Volume boot record
Why it's wrong here
The Volume Boot Record (VBR) is the first sector of a FAT32 volume and stores the BIOS parameter block (BPB), boot code, and filesystem parameters such as cluster size and number of FATs. It does not contain any per-file allocation information or cluster-chain mappings. While it is essential for locating where the FAT starts, it is not the structure an analyst would examine to recover the actual contents of a deleted file. Therefore, it is incorrect because it only provides bootstrapping metadata, not the file allocation data needed for recovery.
- ✗
Directory entry
Why it's wrong here
A directory entry in FAT32 stores metadata such as the file name, attributes, timestamps, file size, and the starting cluster number. When a file is deleted, the first byte of its directory entry is set to 0xE5, marking it as available, but the entry itself often remains until overwritten. However, a single directory entry does not contain the full cluster chain; it only identifies the first cluster of a file. To recover a fragmented or multi-cluster file, the analyst must follow the File Allocation Table, not rely solely on the directory entry, which is why this option is incorrect.
- ✓
File Allocation Table (FAT)
Why this is correct
The File Allocation Table (FAT) is the core structure for recovering deleted files on a FAT32 filesystem. It contains an array of entries that map each cluster to the next cluster in a file's chain, effectively recording how clusters are linked to form files. When a file is deleted, the directory entry is flagged as deleted, but the FAT entries for the file's clusters are often not immediately cleared, leaving the chain intact and recoverable. An analyst can scan the FAT for orphaned clusters and reconstruct the original file by traversing the cluster linkage, making this option the correct choice.
- ✗
Boot sector
Why it's wrong here
The boot sector of a FAT32 volume is nearly synonymous with the Volume Boot Record, containing the jump instruction, original equipment manufacturer (OEM) identifier, BPB, and bootstrap code. It provides critical filesystem parameters such as total sectors, sectors per cluster, and FAT locations, which are necessary for mounting the volume. However, it does not contain any data about individual files or their cluster allocations. It is incorrect because it is merely a blueprint for navigating the volume, not the table that records file cluster sequences required for file recovery.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.