Which of the following is an example of correlating NTFS artifacts with other evidence?

Using the USN Journal to confirm that a file was created at the same time a process was launched, as recorded in the Windows Event Log

Using the $LogFile to recover the file's content

Using the $Volume file to identify the user who created a file

Using the $Bitmap to determine the file's creation time

An examiner is analyzing an MFT entry and finds that the sequence number is 5. Which conclusion is most accurate?

The file has been modified five times, and the sequence number tracks the number of modifications.

The MFT entry has been reused at least five times, indicating the file has been deleted and recreated multiple times.

The file has been renamed five times, and the sequence number tracks the number of renames.

The file has been accessed five times, and the sequence number tracks the number of accesses.

During an investigation, you find that a user has been accessing files on a volume that has disk quotas enabled. You need to determine which files were created by the user and may have contributed to quota usage. Which NTFS system file would be most useful for this analysis?

$Extend\$Quota, which contains quota tracking information for each user.

$Bitmap, which tracks cluster allocation but not user ownership.

$MFT, which contains file records but not user ownership information.

$LogFile, which logs transactions but not quota usage.

You are building a timeline for a system where a file was created, modified, and then deleted. The MFT record is gone, but the $LogFile contains transaction records for the file's creation and modification. The USN journal shows the deletion event. How can you best reconstruct the file's activity timeline?

Use only the $LogFile, as it contains all events including deletion.

Use only the USN journal, as it contains all events including creation and modification.

Use the $LogFile transaction timestamps for creation and modification, and the USN journal timestamp for deletion, correlating them to build the timeline.

Use the $Bitmap to determine when the clusters were allocated and deallocated.

You are investigating a system where a user has been deleting files to avoid quota enforcement. The $Quota file shows that the user's usage is below their quota limit, but the $Bitmap shows many clusters allocated to files that no longer exist in the MFT. What is the most likely explanation?

The deleted files' clusters are still allocated in the $Bitmap, but the $Quota file was not updated to reflect the deletion, indicating the files were deleted without proper cleanup.

The $Bitmap is corrupted and incorrectly shows clusters as allocated.

The user used a tool to bypass quota enforcement, and the $Quota file is inaccurate.

The files were compressed, and compression caused the clusters to remain allocated.

GIAC Certified Forensic Analyst

Domain 3Objective 3

NTFS Artifact Analysis GCFA Practice Questions (Page 2)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

16concepts

Questions 6–10

6foundation · easy
Which of the following is an example of correlating NTFS artifacts with other evidence?
Select an answer first
7application · medium
An examiner is analyzing an MFT entry and finds that the sequence number is 5. Which conclusion is most accurate?
Select an answer first
8application · medium
During an investigation, you find that a user has been accessing files on a volume that has disk quotas enabled. You need to determine which files were created by the user and may have contributed to quota usage. Which NTFS system file would be most useful for this analysis?
Select an answer first
9expert · hard
You are building a timeline for a system where a file was created, modified, and then deleted. The MFT record is gone, but the $LogFile contains transaction records for the file's creation and modification. The USN journal shows the deletion event. How can you best reconstruct the file's activity timeline?
Select an answer first
10expert · hard
You are investigating a system where a user has been deleting files to avoid quota enforcement. The $Quota file shows that the user's usage is below their quota limit, but the $Bitmap shows many clusters allocated to files that no longer exist in the MFT. What is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.