To find deleted files during a forensic investigation on a Linux computer, you search for inodes that contain some data and have a link count of ____.
A) -1
B) 0
C) 1
D) 2

Question

Quizplus · Accepted Answer

In a Linux filesystem, when a file is deleted, its inode's link count is decremented. If the link count reaches 0, it means there are no more references (links) to this inode from any directory, indicating the file has been deleted. However, the inode may still contain data until it is overwritten.

To Find Deleted Files During a Forensic Investigation on a Linux