PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 1 : Search the filesystem journal for pre-deletion copies of the inode that still hold the old block pointers

Advertisement

Detailed Solution

सही उत्तर Search the filesystem journal for pre-deletion copies of the inode that still hold the old block pointers है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

On ext4, a deleted file's inode has its block pointers zeroed, but the examiner still hopes to recover the data. What is the most promising next step? / ext4 पर डिलीट फाइल के इनोड के ब्लॉक पॉइंटर शून्य हो गए हैं, फिर भी परीक्षक डेटा रिकवरी की उम्मीद करता है। सबसे आशाजनक अगला कदम क्या है?

1.
Search the filesystem journal for pre-deletion copies of the inode that still hold the old block pointers
2.
Read the superblock backup, which stores a copy of every deleted file's data
3.
Parse the file allocation table chain, which ext4 maintains alongside inodes
4.
Rely on the inode's deletion-time field alone, which is sufficient to rebuild the file

Correct Answer: Search the filesystem journal for pre-deletion copies of the inode that still hold the old block pointers

The journal often retains recent inode images from before deletion, including intact block pointers; the deletion-time field only records when deletion happened. / जर्नल में डिलीशन से पहले के इनोड चित्र बचे हो सकते हैं जिनमें ब्लॉक पॉइंटर सही हों। Option (d) is the trap — the timestamp records the event but not the data locations.

Downloaded from PrepSnap (prepsnap.in)