Computer Hacking Forensic Investigator (CHFI v10) — Question 329

Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.

Answer options

• A. NTFS
• B. FAT
• C. EXT
• D. FAT32

Correct answer: A

Explanation

The correct answer is NTFS, as it uses the $BitMap file for tracking cluster usage. FAT, EXT, and FAT32 do not employ a $BitMap file to manage their clusters; instead, they utilize different methods for tracking space allocation.