EXTENDED FILESYSTEM FEATURES

As previously mentioned, the extended filesystem supports a number of optional features. These are grouped into compatible, incompatible, and read-only compatible features. Details of these various types of features are presented below.

You may be wondering why a forensic examiner should care about features. This is certainly a fair question. There are a number of reasons why this is relevant to forensics. First, these features may affect the structure of block groups. Second, this in turn affects where data is located. Third, features affect how data is stored. For example, depending on the features used some data may be stored in inodes versus its usual location in data blocks. Fourth, some features might result in a new source of metadata for use in your analysis.