What is the purpose of the $ObjId file in NTFS?

To map object IDs to file references for use by applications like Distributed Link Tracking

To store disk quota information

What information does the $Bitmap file store in NTFS?

A bitmap indicating which clusters on the volume are allocated or free

A list of all file names on the volume

During a forensic examination of an NTFS volume, you need to determine the cluster size and the total number of sectors to calculate the volume size. Which structure should you examine?

The $Boot file, which contains the BIOS Parameter Block (BPB) with sector and cluster information.

The $Volume, which stores volume information such as the volume name and version.

The $MFT, which contains file records with data runs that indicate cluster sizes.

The $Bitmap, which maps cluster allocation and indicates the total number of clusters.

A forensic examiner is analyzing a Windows 10 system and discovers an alternate data stream (ADS) attached to a legitimate executable file. Which action is most appropriate to determine the content and origin of the ADS?

Delete the ADS to prevent the executable from running malicious code.

Check the file's $STANDARD_INFORMATION timestamps to determine when the ADS was created.

Use a forensic tool to list the ADS and extract its content, then compare the content's hash with known malware signatures.

Run the executable in a sandbox to observe if the ADS is executed.

GIAC Certified Forensic Analyst

Domain 3Objective 3

NTFS Artifact Analysis GCFA Practice Questions (Page 7)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

16concepts

Questions 31–35

31foundation · easy
What is the purpose of the $ObjId file in NTFS?
Select an answer first
32foundation · easy
In NTFS, which structure serves as the central catalog that stores metadata about every file and directory on the volume?
Select an answer first
33foundation · easy
What information does the $Bitmap file store in NTFS?
Select an answer first
34application · medium
During a forensic examination of an NTFS volume, you need to determine the cluster size and the total number of sectors to calculate the volume size. Which structure should you examine?
Select an answer first
35application · medium
A forensic examiner is analyzing a Windows 10 system and discovers an alternate data stream (ADS) attached to a legitimate executable file. Which action is most appropriate to determine the content and origin of the ADS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.