nerdexam
EC-Council

312-49V11 · Question #151

A CHFI expert creates a forensics image of a pen drive using AccessData FTK Imager during a computer forensics investigation. The investigator uses The Sleuth Kit (TSK) to examine an ext4 file…

The correct answer is D. istat -B num. In TSK, istat displays inode metadata. The -B option shows the list of allocated block addresses associated with that inode. This is exactly what's needed to examine unexpected block allocation patterns and detect tampering.

Understanding Hard Disks and File Systems

Question

A CHFI expert creates a forensics image of a pen drive using AccessData FTK Imager during a computer forensics investigation. The investigator uses The Sleuth Kit (TSK) to examine an ext4 file system on a Linux disk image and suspects data tampering. The expert decides to verify inode metadata for a critical file. However, he notes an unexpected block allocation in the inode details. Which TSK command-line tool and argument should the investigator utilize to examine the addresses of all allocated disk units for the suspicious inode?

Options

  • Afsstat -f ext4
  • Bimg_stat -i raw
  • Cfls -o imgoffset
  • Distat -B num

How the community answered

(48 responses)
  • A
    4% (2)
  • B
    8% (4)
  • C
    17% (8)
  • D
    71% (34)

Explanation

In TSK, istat displays inode metadata. The -B option shows the list of allocated block addresses associated with that inode. This is exactly what's needed to examine unexpected block allocation patterns and detect tampering.

Topics

#The Sleuth Kit#istat command#inode analysis#ext4 forensics

Community Discussion

No community discussion yet for this question.

Full 312-49V11 Practice