NTFS Artifact Analysis GCFA Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   In an NTFS MFT reference, what is the purpose of the sequence number?

   • ATo store the file's creation time
   • BTo indicate the file's size
   • CTo identify the file's parent directory
   • DTo detect references to a file record that has been reused
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the USN Journal (Update Sequence Number Journal) used for in NTFS?

   • ATo record a log of changes to files and directories on the volume
   • BTo store the MFT
   • CTo manage disk quotas
   • DTo store backup copies of file data
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   You are analyzing a file that was deleted and then its MFT record was reused by a new file. The original file's data is still present in unallocated space. You need to recover the original file's content. Which approach is most likely to succeed?

   • AUse the USN journal to identify the original file's clusters and recover from them.
   • BUse the $LogFile to reconstruct the original file's MFT record and then recover the data.
   • CCarve the unallocated space using the original file's signature and file structure, since the MFT record no longer points to the data.
   • DUse the new file's MFT record to locate the original data runs, since the record may contain remnants of the original file.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   When constructing a timeline from NTFS artifacts, why is it important to correlate timestamps from multiple sources?

   • ATo corroborate events and identify discrepancies that may indicate anti-forensic activity
   • BTo increase the file system's performance
   • CTo recover deleted files
   • DTo determine the volume's serial number
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   You are investigating a system where a file's timestamps were deliberately altered. The $STANDARD_INFORMATION timestamps were changed to 2020, but the $FILE_NAME timestamps still show 2023. The $LogFile contains a transaction that updated the $STANDARD_INFORMATION attribute. What is the most likely sequence of events?

   • AThe file was copied from an old backup, and the SI timestamps reflect the original creation, while the FN timestamps are from the copy operation.
   • BAn attacker used a tool to modify the SI timestamps, and the $LogFile records that transaction, while the FN timestamps remained unchanged.
   • CThe file was renamed, and the rename updated the SI timestamps but not the FN timestamps.
   • DThe $LogFile is unreliable and the SI timestamps are the original, while the FN timestamps were modified.
   Reveal Solution Discussion Select an answer first