GIAC Certified Forensic Analyst
Domain 3Objective 3
NTFS Artifact Analysis GCFA Practice Questions (Page 9)
Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)
58questions here
12free pages
16concepts
Questions 41–45
- 41
When parsing the Master File Table (MFT), which field in a file record header indicates that the record is in use?
Select an answer first - 42
What is an Alternate Data Stream (ADS) in NTFS?
Select an answer first - 43
Which NTFS structure is a collection of attributes that describe a file, including its name, timestamps, and data?
Select an answer first - 44
An examiner is analyzing an NTFS volume and notices a file named '$Extend' in the root directory. Which forensic artifact is most likely to be found within the $Extend directory?
Select an answer first - 45
An examiner is analyzing the $LogFile to reconstruct the state of a file before it was deleted. The $LogFile contains a transaction that shows the file was created, then modified, and then deleted. The current MFT entry for the file is marked as deleted. Which action is most appropriate to recover the file's previous content?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.