Question 397 of 205
CHFI FAT (File Allocation Table) Practice Question
An investigator needs to recover deleted files from a USB drive formatted with FAT32. Which of the following techniques would be most effective, assuming the files have not been overwritten?
⚠ Common exam trap
A common trap is to assume that file carving (D) is always the best method. However, when the file system is intact and the metadata is available, analyzing the FAT provides a more reliable and efficient recovery. Also, note that FAT32 lacks a journal (A) and does not use $MFT (C).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Examine the FAT for unallocated clusters and reconstruct files
FAT32 does not have a journal (eliminating A). The Master File Table ($MFT) is used by NTFS, not FAT32 (eliminating C). While file carving with tools like 'foremost' (D) can recover files based on signatures, it is less effective for deleted files on FAT32 because it may fail to recover fragmented files and does not leverage the file system's own structure. The most effective technique is to examine the File Allocation Table (FAT) for unallocated clusters and reconstruct the files from the directory entry's starting cluster and size (B), assuming the clusters have not been overwritten. This uses the file system metadata to directly locate the file's data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the journal for recent changes
Why it's wrong here
FAT32 is a non-journaling file system; it has no journal, transaction log, or change journal for recording pending metadata updates. While NTFS has an NTFS change journal and ext4 has a journal, FAT simply writes directory and FAT changes directly, so there is nothing to inspect for recent changes. An examiner checking a journal on FAT32 would find no such structure to parse.
- ✓
Examine the FAT for unallocated clusters and reconstruct files
Why this is correct
Correct. FAT32's File Allocation Table stores cluster chains. Deleted files have their FAT entries zeroed but data clusters remain. Examining the FAT for unallocated clusters and reconstructing from the directory entry's starting cluster and size allows recovery if not overwritten.
- ✗
Analyze the $MFT for orphaned entries
Why it's wrong here
The $MFT is an NTFS-specific metadata file that tracks every file and directory via resident attributes; FAT32 has no Master File Table whatsoever. FAT32 instead uses a File Allocation Table plus directory entries, and deleted files are flagged by 0xE5 in the directory entry with their cluster chain zeroed in the FAT. Thus searching for orphaned $MFT entries is fundamentally invalid on a FAT32 USB drive.
- ✗
Use the 'foremost' tool to carve based on file signatures
Why it's wrong here
Correct. File carving tools like 'foremost' recover files based on file signatures (headers/footers) without relying on file system metadata. This works even if the directory entry or FAT is damaged, assuming data is contiguous and not overwritten.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.