During a forensic examination of a Windows 10 system, you find a file named 'report.txt' that appears to contain only a few bytes of text. However, the file's size on disk is much larger than its logical size. Which NTFS feature best explains this discrepancy?

The file has an alternate data stream (ADS) containing additional data.

The file is compressed using NTFS compression, which increases its apparent size.

The file's MFT entry is fragmented across multiple clusters.

The file is sparse, so its logical size is larger than its allocated size.

A forensic examiner is analyzing a USB drive formatted with exFAT and needs to recover a deleted file. Which characteristic of exFAT is most helpful for recovery?

exFAT uses a File Allocation Table that may retain cluster chain information after deletion.

exFAT supports Volume Shadow Copies for deleted file recovery.

exFAT stores file data in the directory entry.

exFAT uses a Master File Table similar to NTFS.

A forensic examiner is analyzing an NTFS volume and finds a file with a $STANDARD_INFORMATION attribute that has a creation time earlier than the $FILE_NAME attribute's creation time. What is the most likely explanation?

The file was renamed or moved, which updated the $FILE_NAME attribute's creation time.

The file was modified, which updated the $STANDARD_INFORMATION attribute.

The file was copied, which updated the $STANDARD_INFORMATION attribute.

A forensic examiner is analyzing a 64 GB USB drive formatted with exFAT. The examiner needs to recover a deleted file. Which of the following is the most important structure to examine?

The directory entry and the clusters that were previously allocated to the file

The File Allocation Table (FAT)

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 2

Windows Filesystems GBFA Practice Questions (Page 3)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

3concepts

Questions 11–15

11application · medium
During a forensic examination of a Windows 10 system, you find a file named 'report.txt' that appears to contain only a few bytes of text. However, the file's size on disk is much larger than its logical size. Which NTFS feature best explains this discrepancy?
Select an answer first
12application · medium
A forensic examiner is analyzing a USB drive formatted with exFAT and needs to recover a deleted file. Which characteristic of exFAT is most helpful for recovery?
Select an answer first
13expert · hard
A forensic examiner is analyzing an NTFS volume and finds a file with a $STANDARD_INFORMATION attribute that has a creation time earlier than the $FILE_NAME attribute's creation time. What is the most likely explanation?
Select an answer first
14foundation · easy
In NTFS, which structure serves as the central catalog that stores one or more file records for every file and directory on the volume?
Select an answer first
15application · medium
A forensic examiner is analyzing a 64 GB USB drive formatted with exFAT. The examiner needs to recover a deleted file. Which of the following is the most important structure to examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.