ReclaiMe Data Recovery Training

Filesystem Recovery Course - VMFS Recovery Test

What parts are there in an inode?

metadata, segment numbers, and payload
metadata and payload
metadata, parent pointers, and payload

VMFS uses only contiguous areas on a disk to store files

false, files can be fragmented
true, files cannot be fragmented

What does payload contain?

up to 1024 pointers or file content
512 pointers to large clusters
any file related data
256 pointers or file content

What is the payload size?

1KB
8KB
512B
2KB

How are large clusters numbered?

arbitrarily
sequentially from the beginning of the volume

Where are small clusters stored?

in inodes
inside a special file
arbitrarily on the volume

What happens when a file is deleted?

metadata in the corresponding inode is overwritten with zeros
an entire inode is overwritten with zeros
payload in the corresponding inode is overwritten with zeros

Where are the numbers of the first and the last segments stored?

in the extent header
in the volume header

What is the recommended data recovery approach for a multi-disk VMFS volume?

do filesystem recovery on each disk separately
first reassemble the volume from extents and then do filesystem recovery
do RAID0 recovery first and then do filesystem recovery

Carving doesn’t work well on a VMFS volume

true
false

We have a mailing list in which we talk about interesting cases we encounter and share some tips and tricks.