What is the purpose of the john.rec file in John the Ripper?

• A. A log of all cracks attempted.
• B. A recovery file used to resume work after a crash.
• C. A configuration cache.
• D. A recovery file updated every 10 minutes during operation.

Answer: (D)

The key idea is that john.rec is a recovery snapshot for a cracking session. John the Ripper writes progress to this file as it runs, so if the process is interrupted you can resume from where you left off. It’s updated periodically during operation—often every 10 minutes—to keep the snapshot fresh and minimize lost work. The recovery file records the current state of the session (like where you are in the queue, which salts and rules are active, etc.), allowing a seamless restart with the same session name. This behavior makes it clear why the recovery file updated on a regular interval is the best description of its purpose.