You are recovering files from a volume that contains both compressed and encrypted files. A compressed file was deleted, and its clusters are now partially overwritten. An encrypted file was also deleted, but its MFT record is intact. Which file is more likely to be fully recoverable?

The encrypted file, because its MFT record is intact and the data may still be present, but decryption requires the user's key.

Both files are equally recoverable because their MFT records are intact.

Neither file is recoverable because both were deleted.

The compressed file, because compression makes the data smaller and less likely to be overwritten.

During an investigation, you locate a deleted file's MFT record in unallocated space. The record's sequence number is 5, but the $MFT's $STANDARD_INFORMATION attribute for the current directory entry shows the file was last referenced with sequence number 4. What does this discrepancy most likely indicate?

The file was compressed, and compression caused the sequence number to increment.

The file was deleted and its MFT record was reused by a new file, then deleted again.

The file was renamed multiple times, causing the sequence number to increment with each rename.

The file was copied to another volume, and the copy inherited a different sequence number.

How can NTFS artifacts be correlated with Windows Event Logs to reconstruct user actions?

By matching file system timestamps with logon and process execution events to establish a sequence of user activity

By reading the $Volume file to identify the user

By analyzing the $Quota file to see user activity

By using the $Bitmap to determine which files were accessed

GIAC Certified Forensic Analyst

Domain 3Objective 3

NTFS Artifact Analysis GCFA Practice Questions (Page 11)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

16concepts

Questions 51–55

51expert · hard
You are recovering files from a volume that contains both compressed and encrypted files. A compressed file was deleted, and its clusters are now partially overwritten. An encrypted file was also deleted, but its MFT record is intact. Which file is more likely to be fully recoverable?
Select an answer first
52foundation · easy
Which NTFS system file contains the USN Journal?
Select an answer first
53application · medium
During an investigation, you locate a deleted file's MFT record in unallocated space. The record's sequence number is 5, but the $MFT's $STANDARD_INFORMATION attribute for the current directory entry shows the file was last referenced with sequence number 4. What does this discrepancy most likely indicate?
Select an answer first
54foundation · easy
When analyzing NTFS timestamps, what does the 'C' in MACB stand for?
Select an answer first
55foundation · easy
How can NTFS artifacts be correlated with Windows Event Logs to reconstruct user actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

NTFS Artifact Analysis GCFA Practice Questions (Page 11)

Questions 51–55

You are recovering files from a volume that contains both compressed and encrypted files. A compressed file was deleted, and its clusters are now partially overwritten. An encrypted file was also deleted, but its MFT record is intact. Which file is more likely to be fully recoverable?

Which NTFS system file contains the USN Journal?

When analyzing NTFS timestamps, what does the 'C' in MACB stand for?

How can NTFS artifacts be correlated with Windows Event Logs to reconstruct user actions?

Keep studying — File System Forensics