According to the CHFI v11 syllabus underOperating System ForensicsandLinux File System Analysis, understanding Linux file systems and their conversion methods is essential for both system administration and forensic investigations. TheEXT2file system is a non-journaling file system, whereasEXT3extends EXT2 by addingjournaling capabilities, which significantly improve system recovery and forensic traceability after crashes or improper shutdowns.

The correct command to convert an existing EXT2 file system into EXT3 is:

/sbin/tune2fs -j

This command enables journaling on the EXT2 file systemwithout reformatting or destroying existing data, making it a safe and efficient conversion method. CHFI v11 explicitly highlights this command as the standard approach for adding a journal to an EXT2 partition. Once journaling is enabled, the file system is recognized as EXT3.

The other options are incorrect and unrelated to Linux file system conversion. Options A and B involveNTFS Alternate Data Streams, which are Windows-specific. Option C is a disk-level command used for copying raw sectors, such as backing up or restoring an MBR, and does not modify file system journaling features.

The CHFI Exam Blueprint v4 emphasizes knowledge ofLinux file systems (EXT2, EXT3, EXT4)and administrative commands liketune2fs, as they are frequently referenced in forensic analysis and recovery scenarios, making Option D the correct and exam-aligned answer