CFA-001 practice question 16 of 25
When the operating system marks cluster as used, but does not allocate them to any file, such clusters are known as ___________.
Full set: 180 questionsDomain Understanding Hard Disks and File Systems
A lost cluster, also known as a lost allocation unit or an orphaned cluster, is a cluster that the file system's allocation table (e.g., FAT) marks as "in use" but is not associated with any file in the directory structure. This file system metadata inconsistency means the operating system has reserved the space, but it cannot be accessed because no file entry points to it. Such clusters often result from a system crash or improper shutdown during a file-writing operation. Disk utility tools like CHKDSK or fsck are used to identify these lost clusters and can either recover them into a file or deallocate them to free up the disk space.
B. Bad clusters: This refers to a physically damaged or unreliable area of the disk that the operating system marks as unusable to prevent data corruption.
C. Empty clusters: This is not a standard file system term; it could ambiguously refer to a cluster containing no data, regardless of its allocation status.
D. Unused clusters: These are clusters correctly marked as "free" or "available" in the file allocation table, representing the disk's usable free space.
1. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 10, "FAT Concepts and Analysis," Section 10.4.1, "Lost Clusters," it is stated: "A lost cluster is an allocated cluster that is not used by any file. These are typically found by scanning the FAT for allocated clusters and comparing that with the clusters that are allocated to files." (p. 261).
2. University of California, Berkeley. (n.d.). CS 162: Operating Systems and Systems Programming, Lecture 20: File Systems. In the discussion of file system consistency checking, the concept of a block (cluster) being marked as used in the allocation structure but not belonging to any file is described as a common inconsistency that tools like fsck resolve. This directly corresponds to the definition of a lost cluster.
3. Microsoft. (2021, September 15). chkdsk. Microsoft Learn. The documentation for the chkdsk command explains its function in checking file system logical and physical errors. It describes one of its primary functions as finding and fixing issues like "lost clusters," which it can convert to files (e.g., FILExxxx.CHK) for potential data recovery.
Keep practicing
Take the free CFA-001 practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other CFA-001 practice questions
- Question 1Which of the following commands shows you the names of all open shared files on a server …
- Question 2Billy, a computer forensics expert, has recovered a large number of DBX files during fore…
- Question 3Hash injection attack allows attackers to inject a compromised hash into a local session …
- Question 4The Apache server saves diagnostic information and error messages that it encounters whil…
- Question 5First response to an incident may involve three different groups of people, and each will…
- Question 6The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to …
