CHFI Storage Forensics and File System Analysis Practice Question
In ext3/ext4 file systems, which THREE of the following are key structures used for file metadata and recovery?
⚠ Common exam trap
CHFI often tests the distinction between filesystem-specific structures (e.g., ext3/ext4 vs. NTFS vs. FAT), so candidates mistakenly associate $MFT or FAT with Linux filesystems due to general file system knowledge.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Journal
The Journal (A) is correct because ext3/ext4 are journaling file systems that record pending metadata (and optionally data) transactions to a circular log, enabling fast crash recovery and consistency by replaying or discarding incomplete operations. The Superblock (B) is correct because it stores critical file system metadata such as block size, total inode and block counts, mount state, and pointers to block group descriptors, and ext3/ext4 keep backup superblocks for recovery if the primary is corrupted. The Inode table (E) is correct because each file or directory is represented by an inode holding metadata (permissions, timestamps, ownership, size, and block pointers), and the inode table is the on-disk array of these inodes. The Master File Table (C) is not correct because $MFT is the core metadata structure of NTFS, not ext3/ext4. The File Allocation Table (D) is not correct because FAT is the allocation structure of the FAT12/FAT16/FAT32 file systems, not ext3/ext4.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Journal
Why this is correct
The journal is a dedicated circular area (or a separate journal device) that records pending metadata changes before they are committed to the main filesystem, providing crash consistency and fast recovery. In ext3 this is implemented by the Journaling Block Device (JBD), and ext4 uses JBD2, which supports checksums and more flexible journaling modes. This journal is a defining feature of ext3/ext4 that distinguishes them from earlier ext2, making it a correct ext3/ext4 component.
- ✓
Superblock
Why this is correct
The superblock is a filesystem-level header that stores critical parameters such as block size, total and free block counts, inode counts, filesystem state, and feature compatibility flags. It appears at the beginning of the filesystem and is redundantly copied across block groups to allow recovery if the primary is corrupted. The superblock is essential for mounting and interpreting the filesystem, and it is one of the main structures that forensic tools examine first.
- ✗
Master File Table ($MFT)
Why it's wrong here
The Master File Table ($MFT) is a special file in the NTFS filesystem that contains a sequence of 1024-byte records, each describing a file or directory via attributes like $STANDARD_INFORMATION, $DATA, and $FILE_NAME. It is unique to Microsoft's NTFS and has no counterpart in ext3/ext4, where file metadata is stored in inodes scattered across the inode table. Therefore, the $MFT is not a component of ext3/ext4, making this option incorrect.
- ✗
File Allocation Table (FAT)
Why it's wrong here
The File Allocation Table (FAT) is a table of cluster entries used by the FAT12, FAT16, and FAT32 filesystems to track which clusters are allocated to each file, forming linked chains. It is a legacy Microsoft and IBM structure that does not exist in ext3/ext4; instead, these filesystems use inode pointers and block group bitmaps for allocation. Since the FAT is not part of the ext3/ext4 on-disk layout, it is an incorrect answer.
- ✓
Inode table
Why this is correct
The inode table is an on-disk array of inodes, each containing file metadata such as permissions, timestamps, ownership, file size, and block pointers (or extent trees in ext4). It is a core structural component of the ext3/ext4 filesystem, with inode bitmaps tracking allocation within each block group. Without the inode table, file names cannot be resolved to their data, making it indispensable for filesystem operation and forensic analysis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.