312-49V11: Computer Hacking Forensic InvestigatorDemo

Question

Emily, an experienced digital forensics investigator, is assigned to investigate a Linux system that uses the ext2 file system. The system was implicated in a suspected data-exfiltration incident, and Emily must collect detailed metadata for a particular file that may have been accessed or changed during the attack.

After examining the system’s file system structure, Emily wants to focus on the source containing the file’s metadata, including timestamps, permissions, and file size. Which of the following is the best source for this critical information?

A The dentry cache
B The inode table
C The file’s data blocks
D The superblock

Explanation

In ext2, each file’s inode contains its metadata, including permissions, timestamps, file size, ownership information, and references to the file’s data blocks. The inode table stores these inodes.

312-49V11: Computer Hacking Forensic InvestigatorDemo

AstroTutor

Notes

Readiness

QuestionQ34

Community Discussion