nerdexam
GIAC

GCFA · Question #192

Rick works as a Network Administrator for uCertify Inc. He takes a backup of some important compressed files on an NTFS partition, using the Windows 2000 Backup utility. Rick restores these files in…

The correct answer is A. A FAT32 partition does not support compression. FAT32 does not support NTFS compression, so files restored from an NTFS partition to a FAT32 partition lose their compression attribute automatically.

File System & Registry Forensics

Question

Rick works as a Network Administrator for uCertify Inc. He takes a backup of some important compressed files on an NTFS partition, using the Windows 2000 Backup utility. Rick restores these files in a FAT32 partition. He finds that the restored files do not have the compression attribute. What is the most likely cause?

Options

  • AA FAT32 partition does not support compression.
  • BThe FAT32 partition is corrupt and requires to be reformatted.
  • CThe Windows 2000 Backup utility decompresses compressed files while taking a backup.
  • DThe backup of files that are saved on an NTFS partition cannot be restored in a FAT32 partition.

How the community answered

(31 responses)
  • A
    71% (22)
  • B
    3% (1)
  • C
    16% (5)
  • D
    10% (3)

Why each option

FAT32 does not support NTFS compression, so files restored from an NTFS partition to a FAT32 partition lose their compression attribute automatically.

AA FAT32 partition does not support compression.Correct

FAT32 is an older file system that lacks native support for NTFS-specific features including file compression, Encrypting File System (EFS), and granular ACL permissions. When Windows Backup restores NTFS-compressed files to a FAT32 partition, those NTFS attributes cannot be stored and are silently dropped, explaining why the compression attribute is absent on the restored files.

BThe FAT32 partition is corrupt and requires to be reformatted.

A corrupt FAT32 partition would prevent restoration entirely or produce data errors, not simply cause a specific file attribute like compression to be missing from otherwise intact restored files.

CThe Windows 2000 Backup utility decompresses compressed files while taking a backup.

Windows 2000 Backup preserves files in their compressed state during the backup operation and does not decompress them at backup time - decompression occurs only when the destination file system cannot support the attribute.

DThe backup of files that are saved on an NTFS partition cannot be restored in a FAT32 partition.

The restore operation itself succeeds without error when moving files from NTFS to FAT32 - the limitation is not that the restore is blocked, but that FAT32 cannot store NTFS-specific attributes, so they are not applied to the restored files.

Concept tested: FAT32 vs NTFS file system compression attribute support

Source: https://learn.microsoft.com/en-us/windows/win32/fileio/file-system-functionality-comparison

Topics

#NTFS compression#FAT32#file system attributes#Windows backup

Community Discussion

No community discussion yet for this question.

Full GCFA Practice