CHFI Storage Forensics and File System Analysis Practice Question
Which file system journal is commonly used in Linux ext3/ext4 to record metadata changes before they are committed to the main file system?
⚠ Common exam trap
The EC-Council CHFI exam often tests the confusion between Windows-specific artifacts (like $LogFile or USN Journal) and Linux journaling mechanisms, expecting candidates to recognize that ext3/ext4 rely on JBD/JBD2 rather than NTFS structures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Journal (JBD/JBD2)
The ext3 and ext4 file systems in Linux use the Journal (JBD/JBD2) layer to record metadata changes in a circular log before they are committed to the main file system. This journaling mechanism ensures file system consistency after a crash by allowing replay of committed transactions, with JBD2 specifically supporting ext4's 64-bit features and checksums.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$LogFile
Why it's wrong here
$LogFile is the NTFS transaction journal on Windows, not a Linux ext3/ext4 journal; ext3/ext4 record metadata changes in the journal inode. It is tempting because both are file-system journals recording metadata before commit, and would be correct when analysing NTFS volumes during forensic examination.
- ✓
Journal (JBD/JBD2)
Why this is correct
JBD/JBD2 is the journaling layer embedded in ext3 and ext4, recording metadata transactions in a circular log before committing them to the main file system. This satisfies the stem's requirement for a Linux journal that captures metadata changes pre-commit, enabling fast crash recovery and consistency checks.
- ✗
Recycle Bin
Why it's wrong here
The Recycle Bin is a Windows shell feature that stages deleted files for user restoration; it records nothing about ext3/ext4 metadata transactions. It is tempting as a recovery artefact, but the JBD2 journal is what logs metadata before commit, so the Recycle Bin cannot satisfy this requirement.
- ✗
USN Journal
Why it's wrong here
The USN Journal is an NTFS change journal recording file and directory modifications on Windows volumes; it has no role in ext3/ext4, which use the JBD2 journal to log metadata transactions before commit. It is tempting because it also journals file-system changes, but that mechanism belongs to NTFS, not Linux.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.