Cybersecurity and Digital Forensics Practice Test

Journaling is about recording planned changes in a separate log before they are written to the main file system structures. This helps the system recover to a consistent state after crashes by replaying or applying those logged updates in the correct order. For forensic artifact extraction, that log becomes an extra source of timeline information: it can reveal what operations were intended, in what sequence, and what metadata changes were being attempted even if the final on-disk state isn’t fully consistent after a crash.

However, this can complicate artifact extraction because journal entries don’t always map directly to visible file states. Some operations may be metadata-only or staged in the journal before the actual data blocks are written, so timestamps and the appearance of files in the directory tree can differ between the journal and the final filesystem view. The impact also depends on the journaling mode (whether the system records metadata, data, or both). Investigators should consider both the journal and the live filesystem to accurately reconstruct events, and be aware that journal entries can be overwritten or truncated as space is reclaimed.

The other statements aren’t accurate: journaling does not automatically encrypt data, it does not prevent metadata changes, and it does not remove logs to save space.