CHFI Storage Forensics and File System Analysis Practice Question
Which two of the following are characteristics of the ext4 file system? (Choose TWO.)
⚠ Common exam trap
EC-CHFI often tests the distinction between file system-specific structures (like $MFT for NTFS vs. inodes for ext4) and the misconception that all modern file systems use B-trees for directories, when ext4 actually uses HTrees (a variant of hash trees).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Uses a journal to maintain file system consistency
Option C is correct because ext4 is a journaling file system: it writes metadata (and optionally data) changes to a journal before committing them to the main file system, so an interrupted operation can be replayed or rolled back to keep the file system consistent. Option E is correct because ext4 introduced extents, which describe a contiguous range of blocks with a single descriptor instead of one pointer per block, reducing fragmentation overhead and improving performance for large files. Option A is wrong because the Master File Table ($MFT) is an NTFS structure, not an ext4 one. Option B is wrong because a file allocation table (FAT) belongs to FAT12/FAT16/FAT32, whereas ext4 uses inodes and block bitmaps. Option D is wrong because ext4 uses H-tree (hashed B-tree) indexing for directory entries, not a plain B-tree structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Uses a Master File Table ($MFT) to store file metadata
Why it's wrong here
The Master File Table ($MFT) is a relational database-like structure that stores metadata for every file and directory on NTFS, with each file represented by a record describing attributes, timestamps, and data runs. The ext4 file system, by contrast, uses inode tables where each inode contains metadata such as permissions, ownership, size, and pointers to data blocks. Because $MFT is a defining and proprietary feature of NTFS, it is not a characteristic of ext4.
- ✗
Uses a file allocation table (FAT) to track clusters
Why it's wrong here
A file allocation table (FAT) is a linked list of cluster numbers that maps file clusters to data areas, used by FAT12/16/32 file systems, where the table itself is stored as a separate region. The ext4 file system does not use a FAT; instead it tracks free blocks with block bitmaps and allocates space via inodes and extents. Thus, the presence of a FAT clearly indicates a FAT-family file system, not ext4.
- ✓
Uses a journal to maintain file system consistency
Why this is correct
ext4 is a journaling file system that logs pending metadata and sometimes data changes to a journal area on disk before committing them to their final location, enabling rapid recovery and consistency after a crash or power failure. It supports journaling modes such as ordered, writeback, and journal, each balancing performance against consistency guarantees. This journaling mechanism is a definitive characteristic of ext4.
- ✗
Stores directory entries in a B-tree structure
Why it's wrong here
ext4 does not store directory entries in a simple B-tree structure as a general rule; for small directories it uses a linear list of entries, and for larger directories it employs an HTree index, which is a hashed B-tree variant (also called a directory tree) that enables fast lookup by hashing file names. The option's phrasing 'B-tree structure' is therefore misleading, because ext4's directory indexing is specifically an HTree, not a classic B-tree, and it is not a primary structural characteristic of the file system overall.
- ✓
Supports extents for contiguous block allocation
Why this is correct
ext4 introduced extents as a method of mapping files, where each extent describes a contiguous run of blocks with a start block number and length, replacing the older indirect block mapping scheme used in ext2/ext3. Extents greatly reduce metadata overhead for large files and improve performance by allowing the file system to allocate and reference contiguous disk space more efficiently. This support for extents is a defining feature of ext4.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.