Emily, a seasoned digital forensics investigator, has been tasked with conducting an investigation on a...

Option D. The inode table is the correct answer because, in Linux file systems such as ext2, file metadata including timestamps, permissions, ownership, and file size is stored in the file’s inode , not in the file’s content blocks. CHFI v11 explicitly includes Windows, Linux, and macOS File Systems , Linux File System Analysis Tools , and File System Analysis using The Sleuth Kit (TSK) , showing that exam candidates are expected to understand file-system structures and where key forensic metadata resides.

The data blocks contain file content, while the superblock stores overall file-system-level information such as layout and status. The dentry cache is a kernel memory structure related to name lookups and is not the primary persistent source for file metadata in this context. For detailed per-file forensic metadata, the examiner must look at the inode information.

Therefore, when Emily wants the most critical metadata about a specific ext2 file, the best source is the inode table , because that is where the file’s core descriptive attributes are maintained.