312-49 · Question #571
Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.
The correct answer is A. NTFS. NTFS (New Technology File System) uses a special metadata file called $BitMap, stored in the Master File Table (MFT), to track cluster allocation across the volume. Each bit in $BitMap corresponds to one cluster: 1 = allocated, 0 = free. This is a fundamental NTFS metadata file f
Question
Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.
Options
- ANTFS
- BFAT
- CEXT
- DFAT32
How the community answered
(28 responses)- A93% (26)
- B4% (1)
- D4% (1)
Explanation
NTFS (New Technology File System) uses a special metadata file called $BitMap, stored in the Master File Table (MFT), to track cluster allocation across the volume. Each bit in $BitMap corresponds to one cluster: 1 = allocated, 0 = free. This is a fundamental NTFS metadata file forensic investigators examine to identify deleted file remnants or unallocated space. FAT/FAT32 use the File Allocation Table for cluster tracking, and EXT file systems use block bitmaps in a different structure.
Topics
Community Discussion
No community discussion yet for this question.