CHFI Storage Forensics and File System Analysis Practice Question
During a forensic investigation, an examiner wants to recover deleted files from a FAT32 file system. Which structure is most critical for file recovery?
⚠ Common exam trap
The CHFI exam often tests the misconception that all file systems use a similar metadata structure (like MFT or inode tables), leading candidates to confuse FAT32 with NTFS or ext-based systems, when in fact FAT32 relies solely on the File Allocation Table for cluster chain recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File Allocation Table (FAT)
In FAT32, the File Allocation Table (FAT) is the primary structure that tracks cluster allocation chains for files. When a file is deleted, the directory entry is marked as available, but the FAT entries (cluster chains) often remain intact until overwritten, making the FAT the most critical structure for recovering deleted files by reconstructing their cluster sequences.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
File Allocation Table (FAT)
Why this is correct
The File Allocation Table is the core metadata structure of FAT32, storing a linked list of cluster numbers (cluster chains) for every file. When a file is deleted, its directory entry is marked with byte 0xE5 but the associated FAT cluster chain is often left intact until those clusters are reused, and the directory entry still contains the starting cluster and file size. By reading the starting cluster and following the FAT chain to the end-of-chain marker, forensic tools can reassemble the deleted file's data clusters back into a contiguous stream for recovery.
- ✗
Master File Table (MFT)
Why it's wrong here
The Master File Table is the central metadata database of the NTFS filesystem, where each file or directory has a record containing security IDs, timestamps, data attributes, and resident/non-resident data pointers. FAT32 does not use an MFT at all; its file metadata is stored in 32-byte directory entries and its data layout is governed by the File Allocation Table. Since the evidence filesystem is FAT32, there is no MFT to parse or recover from, making this answer incorrect for the recovery scenario.
- ✗
Journal
Why it's wrong here
A journal is a transactional log that journals major filesystem changes so they can be replayed after an unclean shutdown; it is present in journaling file systems such as NTFS ($LogFile) and ext3/ext4, but FAT32 is a non-journaled file system. FAT32 has no journal structure, so there are no journal entries containing the deleted file's metadata, cluster runs, or directory updates that could be replayed. Therefore, any attempt to locate a journal on a FAT32 volume for deleted-file recovery would be fundamentally impossible.
- ✗
Inode table
Why it's wrong here
The inode table is a filesystem metadata structure used by ext2, ext3, ext4, and other Unix-style file systems; each inode stores file permissions, ownership, timestamps, and direct/indirect block pointers. FAT32 stores files using directory entries and the File Allocation Table, which is a flat array of cluster pointers rather than a table of inode objects. Because the target filesystem is FAT32, there are no inodes available—recovering the file would require parsing directory entries and FAT chain entries, not inode table records.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.