NTFS Artifact Analysis GCFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An examiner is attempting to recover a deleted file on an NTFS volume. The $Bitmap shows that clusters 1000-1003 are marked as allocated, but the $MFT entry for the deleted file indicates that its data runs point to clusters 1000-1003. Which action is most appropriate?

   • AIgnore the $Bitmap and carve the clusters directly because the $MFT entry is the authoritative source for the file's data runs.
   • BUse the $LogFile to determine the original data runs and recover the file from the journal.
   • CConclude that the file's data is unrecoverable because the clusters are marked as allocated.
   • DTreat the clusters as potentially containing the deleted file's data, but verify whether they have been reallocated to another file by checking the current $MFT entries.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which NTFS structure contains the volume serial number and the location of the MFT?

   • AThe boot sector ($Boot)
   • BThe $Bitmap file
   • CThe $MFT file itself
   • DThe $Volume file
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are recovering files from a drive that had a folder encrypted with EFS. The user's profile and encryption certificates are unavailable. Which statement best describes the forensic impact on recovering the encrypted files?

   • AThe files' content is inaccessible without the user's EFS private key, but metadata such as timestamps and filenames may still be recoverable from the MFT.
   • BThe files are fully recoverable because EFS encryption is only applied to the $DATA attribute and can be reversed with forensic tools.
   • CThe files are recoverable if the $LogFile contains the encryption key.
   • DThe files are unrecoverable because EFS encrypts the entire MFT record, including metadata.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An examiner is attempting to recover a deleted file on an NTFS volume. The $MFT entry for the deleted file is still present, but the $Bitmap shows that the clusters previously used by the file are now marked as allocated. Which action is most appropriate?

   • AConclude that the file is unrecoverable because the clusters are allocated.
   • BCheck the current $MFT entries to see if any other file has been allocated those clusters, and if not, attempt to recover the data from the clusters.
   • CUse the $LogFile to reconstruct the file's data from the journal.
   • DIgnore the $Bitmap and carve the clusters directly because the $MFT entry is the authoritative source.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does NTFS compression affect forensic recovery of file data?

   • ACompressed files are always stored in the MFT record
   • BCompressed files cannot be recovered after deletion
   • CCompressed data must be decompressed before analysis, and the original uncompressed data may not be recoverable from unallocated space
   • DCompression has no effect on forensic analysis
   Reveal Solution Discussion Select an answer first