GCFA File System Timeline Artifact Analysis Practice Question
A forensic analyst is examining an ext4 file system image from a Linux server. Using fls and istat from The Sleuth Kit, the analyst sees a deleted file whose inode still contains block pointers that now point to blocks reallocated to another file. The analyst wants to determine whether the deleted file's content can be recovered intact. Which ext4 condition best explains why the content is likely unrecoverable?
⚠ Common exam trap
The trap here is believing that a surviving inode with block pointers guarantees recoverable content, when block reallocation and overwrite are what actually destroy the data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file's data blocks have been reallocated to another inode, so the original content is overwritten
On ext4, deleting a file frees its data blocks but often leaves the inode's block pointers intact until the inode is reused. Recovery is possible only while those blocks remain unallocated and unmodified. When the blocks are reallocated to another file and written, the original data is overwritten, so the deleted file's content cannot be recovered intact even though the inode still references the block numbers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ext4 extent tree was converted to indirect block mapping, invalidating the pointers
Why it's wrong here
ext4 uses extents by default, and a file may use indirect block mapping if extents are disabled, but conversion between the two does not occur on deletion. The scenario describes reallocated blocks, not a mapping format change. Because ext4 does not convert extent trees to indirect mapping during deletion, this condition does not explain the loss of recoverable content.
- ✓
The file's data blocks have been reallocated to another inode, so the original content is overwritten
Why this is correct
When ext4 deletes a file, the inode's block pointers may remain until the inode is reused, but the blocks themselves are returned to the free pool. If those blocks are reallocated to another file and written, the original content is overwritten. In this scenario, the pointers now reference blocks owned by another inode, meaning the data is no longer intact and recovery of the original content is not possible from those blocks.
- ✗
The inode's deletion time in the superblock has been overwritten by the journal
Why it's wrong here
ext4 does not store a per-inode deletion time in the superblock, and the journal does not overwrite deletion times in that way. Deletion time is typically inferred from metadata changes or journal transactions, not from a superblock field. This option misstates ext4 structures, so it does not explain why the deleted file's content blocks are unrecoverable when reallocated.
- ✗
The inode's link count was set to zero, which automatically zeroes all data block pointers
Why it's wrong here
Setting a link count to zero marks the inode as deleted, but ext4 does not immediately zero the block pointers. The pointers often remain until the inode is reused, which is why deleted file recovery is sometimes possible. Because the pointers are not zeroed automatically, this option does not explain why the content is unrecoverable; the actual cause is block reallocation and overwrite.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.