NTFS Artifact Analysis GCFA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which NTFS attribute contains the file name and the reference to the parent directory?

   • A$FILE_NAME
   • B$SECURITY_DESCRIPTOR
   • C$STANDARD_INFORMATION
   • D$DATA
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which NTFS artifacts are commonly used to build a timeline of file system activity?

   • AThe $Bitmap and $MFT mirror
   • BThe boot sector and $Volume file
   • CMFT timestamps, USN Journal entries, and $LogFile records
   • DThe $Quota and $ObjId files
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which tool or method can be used to detect alternate data streams on an NTFS volume?

   • ARunning 'dir /a' in Windows Explorer
   • BChecking the file's size in Properties
   • CUsing the 'type' command to view the file
   • DUsing a forensic tool that parses the MFT and lists all $DATA attributes for each file
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an investigation, you need to determine when a file was last accessed on an NTFS volume. Which NTFS attribute should you examine?

   • AThe $STANDARD_INFORMATION attribute, which contains the last access time.
   • BThe $LogFile, which records the last access time.
   • CThe $DATA attribute, which contains the last access time.
   • DThe $FILE_NAME attribute, which contains the last access time.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   You are investigating a system where the USN journal has been cleared, but you need to determine if a specific file was accessed. The MFT record for the file is intact, and the $STANDARD_INFORMATION last-access timestamp is 10:00. However, the $FILE_NAME last-access timestamp is 09:00. Which timestamp is more reliable for determining when the file was last accessed?

   • ANeither timestamp, because the USN journal is the only reliable source for access times.
   • BThe $FILE_NAME last-access timestamp, because it is updated more frequently.
   • CBoth timestamps, because they are always updated together.
   • DThe $STANDARD_INFORMATION last-access timestamp, because it is updated on file access and is the primary source for access time.
   Reveal Solution Discussion Select an answer first