CHFI Storage Forensics and File System Analysis Practice Question
In an ext4 file system, a forensic analyst needs to examine the journal to recover recently deleted files. Where is the journal typically stored?
⚠ Common exam trap
The CHFI exam often tests the misconception that the journal is stored in a fixed reserved area (like after the superblock) rather than as a file associated with a special inode, leading candidates to choose Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In a special inode (inode 8)
In ext4, the journal is stored as a regular file associated with a special inode, typically inode 8. This design allows the journal to be managed by the file system's standard inode and block allocation mechanisms, rather than being placed in a fixed reserved area. When a file is deleted, its data blocks may still be referenced in the journal until they are overwritten, enabling recovery by replaying or analyzing journal entries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In a reserved area after the superblock
Why it's wrong here
The ext4 journal is not stored in a reserved area immediately following the superblock. While ext4 does reserve some blocks after the superblock for backup superblocks and group descriptor copies, the journal is a separate filesystem object. In ext4, the journal is created as a regular inode with a specific number (usually inode 8) or as an external device. The area after the superblock contains structural metadata, not the journal data itself.
- ✗
In the superblock
Why it's wrong here
The superblock in ext4 stores critical filesystem-wide metadata such as total block counts, free inode counts, block size, feature flags, and mount state. It does not contain the journal or its contents. The journal's location is recorded in the superblock via the s_journal_inum and s_journal_dev fields, but the actual journal data lives in the designated inode or device. Examining the superblock would reveal the pointer to the journal, not the journal itself.
- ✓
In a special inode (inode 8)
Why this is correct
In ext4, the default journal is stored as a special inode, typically inode 8. This inode is allocated when the filesystem is created with a journal, and it contains the journal blocks that record metadata and data changes for recovery. The superblock's s_journal_inum field points to this inode number, confirming its role. The journal inode is not a regular file; it is marked as a special filesystem object, and its data blocks are used exclusively for journaling.
- ✗
In the group descriptor table
Why it's wrong here
The group descriptor table contains per-block-group metadata, including block and inode bitmaps locations, free block counts, and checksums. It does not store journal data. Each group descriptor describes the layout of a block group, but the journal is a single contiguous or non-contiguous set of blocks managed by the journal inode. The group descriptor table is part of filesystem structural metadata, which is separate from the journaling subsystem.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.