ReclaiMe Data Recovery Training

Filesystem Recovery Course - VMFS Recovery Test

What is the size of VMFS inode?

8 KB
1 KB
2 KB

What happens when a file is deleted?

payload in the corresponding inode is overwritten with zeros
metadata in the corresponding inode is overwritten with zeros
an entire inode is overwritten with zeros

What parts are there in an inode?

metadata and payload
metadata, parent pointers, and payload
metadata, segment numbers, and payload

Where does VMFS store files smaller than 1 KB?

in a dedicated repository
in indirect blocks table
inside the corresponding inodes

How are large clusters numbered?

arbitrarily
sequentially from the beginning of the volume

Where are small clusters stored?

arbitrarily on the volume
in inodes
inside a special file

What metadata is stored in an inode?

date and time of file creation, the file size, and file name
date and time of file creation, the file size, and the file type
date and time of file creation, the file name, and the file type

Where are the numbers of the first and the last segments stored?

in the volume header
in the extent header

What is the recommended data recovery approach for a multi-disk VMFS volume?

do RAID0 recovery first and then do filesystem recovery
do filesystem recovery on each disk separately
first reassemble the volume from extents and then do filesystem recovery

Carving doesn’t work well on a VMFS volume

false
true

We have a mailing list in which we talk about interesting cases we encounter and share some tips and tricks.