A user reports that a critical file was deleted, and you need to recover it. The MFT record for the file is intact, but the $DATA attribute is non-resident and the file's clusters are marked allocated in the $Bitmap. The file system is NTFS, and the volume has been in use since the deletion. Which recovery approach is most likely to yield the best results?

Attempt to recover the file from the MFT record's data runs, even though the clusters are allocated, and then carve unallocated space for remnants.

Use the USN journal to identify when the file was deleted and then restore from a shadow copy.

Use the $LogFile to reconstruct the file's original data runs and then recover from those clusters.

Use the $Bitmap to find unallocated clusters that may contain the file's data and carve from them.

What forensic information can be obtained from the NTFS $Volume file?

The list of all files on the volume

Which of the following is a forensic implication of non-resident NTFS data?

The data may be fragmented across multiple clusters on the disk

The data is stored in the MFT record and is always recoverable

The data cannot be recovered after deletion

You are investigating a system where a file was modified and then quickly deleted. The MFT record for the file is gone, but you need to determine what changes were made. Which NTFS artifact is most likely to contain a record of the file's prior state?

The $Boot sector, which contains file system parameters but not file history.

The $Bitmap, which tracks cluster allocation and can show which clusters were used by the file.

The $Extend\$ObjId, which tracks object IDs but not file modifications.

The NTFS journal ($LogFile), which logs file system transactions including attribute updates.

GIAC Certified Forensic Analyst

Domain 3Objective 3

NTFS Artifact Analysis GCFA Practice Questions (Page 3)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

16concepts

Questions 11–15

11expert · hard
A user reports that a critical file was deleted, and you need to recover it. The MFT record for the file is intact, but the $DATA attribute is non-resident and the file's clusters are marked allocated in the $Bitmap. The file system is NTFS, and the volume has been in use since the deletion. Which recovery approach is most likely to yield the best results?
Select an answer first
12foundation · easy
What forensic information can be obtained from the NTFS $Volume file?
Select an answer first
13foundation · easy
Which of the following is a forensic implication of non-resident NTFS data?
Select an answer first
14application · medium
You are investigating a system where a file was modified and then quickly deleted. The MFT record for the file is gone, but you need to determine what changes were made. Which NTFS artifact is most likely to contain a record of the file's prior state?
Select an answer first
15foundation · easy
Which NTFS attribute is responsible for storing the file's creation, modification, and access timestamps?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

NTFS Artifact Analysis GCFA Practice Questions (Page 3)

Questions 11–15

What forensic information can be obtained from the NTFS $Volume file?

Which of the following is a forensic implication of non-resident NTFS data?

You are investigating a system where a file was modified and then quickly deleted. The MFT record for the file is gone, but you need to determine what changes were made. Which NTFS artifact is most likely to contain a record of the file's prior state?

Which NTFS attribute is responsible for storing the file's creation, modification, and access timestamps?

Keep studying — File System Forensics