In an MFT file record, which attribute is used to locate the file's data when the data is too large to fit in the record?

$STANDARD_INFORMATION attribute

$DATA attribute with a data run list

When a file is deleted on NTFS, what happens to its MFT file record?

The record is moved to the $Recycle Bin

The record is marked as not in use, but the attributes may remain until the record is reused

The record is deleted from the MFT entirely

The record is immediately overwritten with zeros

An examiner is investigating a suspected data exfiltration incident. The USN journal contains a record for a file named 'archive.zip' with reason 'FILE_CREATE' at 14:32, followed by a record for the same file with reason 'FILE_DELETE' at 14:35. The file is not present in the current file system. Which conclusion is most consistent with this evidence?

The file was moved from another location, and the USN journal records the move as a create and delete.

The file was encrypted, and the USN journal records the encryption as a create and delete.

The file was overwritten by another file, and the USN journal records the overwrite as a create and delete.

The file was created and then deleted within a short time, possibly indicating the file was created for temporary use and then removed to cover tracks.

GIAC Certified Forensic Analyst

Domain 3Objective 3

NTFS Artifact Analysis GCFA Practice Questions (Page 5)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

16concepts

Questions 21–25

21foundation · easy
In an MFT file record, which attribute is used to locate the file's data when the data is too large to fit in the record?
Select an answer first
22foundation · easy
When a file is deleted on NTFS, what happens to its MFT file record?
Select an answer first
23foundation · easy
Which NTFS system file is used to track disk quota information?
Select an answer first
24foundation · easy
Which NTFS attribute contains the 'birth' or creation timestamp for a file?
Select an answer first
25application · medium
An examiner is investigating a suspected data exfiltration incident. The USN journal contains a record for a file named 'archive.zip' with reason 'FILE_CREATE' at 14:32, followed by a record for the same file with reason 'FILE_DELETE' at 14:35. The file is not present in the current file system. Which conclusion is most consistent with this evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

NTFS Artifact Analysis GCFA Practice Questions (Page 5)

Questions 21–25

In an MFT file record, which attribute is used to locate the file's data when the data is too large to fit in the record?

When a file is deleted on NTFS, what happens to its MFT file record?

Which NTFS system file is used to track disk quota information?

Which NTFS attribute contains the 'birth' or creation timestamp for a file?

Keep studying — File System Forensics