CFA-001 practice question 16 of 25

When the operating system marks cluster as used, but does not allocate them to any file, such clusters are known as ___________.

Full set: 180 questions

Domain Understanding Hard Disks and File Systems

Answer options
A: Lost clusters Correct answer
B: Bad clusters
C: Empty clusters
D: Unused clusters
Correct Answer:
A. Lost clusters
Explanation

A lost cluster, also known as a lost allocation unit or an orphaned cluster, is a cluster that the file system's allocation table (e.g., FAT) marks as "in use" but is not associated with any file in the directory structure. This file system metadata inconsistency means the operating system has reserved the space, but it cannot be accessed because no file entry points to it. Such clusters often result from a system crash or improper shutdown during a file-writing operation. Disk utility tools like CHKDSK or fsck are used to identify these lost clusters and can either recover them into a file or deallocate them to free up the disk space.

Why Incorrect

B. Bad clusters: This refers to a physically damaged or unreliable area of the disk that the operating system marks as unusable to prevent data corruption.
C. Empty clusters: This is not a standard file system term; it could ambiguously refer to a cluster containing no data, regardless of its allocation status.
D. Unused clusters: These are clusters correctly marked as "free" or "available" in the file allocation table, representing the disk's usable free space.

References

1. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 10, "FAT Concepts and Analysis," Section 10.4.1, "Lost Clusters," it is stated: "A lost cluster is an allocated cluster that is not used by any file. These are typically found by scanning the FAT for allocated clusters and comparing that with the clusters that are allocated to files." (p. 261).

2. University of California, Berkeley. (n.d.). CS 162: Operating Systems and Systems Programming, Lecture 20: File Systems. In the discussion of file system consistency checking, the concept of a block (cluster) being marked as used in the allocation structure but not belonging to any file is described as a common inconsistency that tools like fsck resolve. This directly corresponds to the definition of a lost cluster.

3. Microsoft. (2021, September 15). chkdsk. Microsoft Learn. The documentation for the chkdsk command explains its function in checking file system logical and physical errors. It describes one of its primary functions as finding and fixing issues like "lost clusters," which it can convert to files (e.g., FILExxxx.CHK) for potential data recovery.

Scroll to Top