GCFA › NTFS Artifact Analysis
This domain covers how NTFS stores metadata and change history across $MFT, $STANDARD_INFORMATION, $FILE_NAME, $LogFile, and $UsnJrnl. GCFA questions present imaging or live-response scenarios and ask you to identify which artifact proves a rename, creation, deletion, or timestamp inconsistency, and to reason about record ordering and journal retention.
GCFA NTFS Artifact Analysis — All 58 Questions
Every question in this domain with answers and detailed explanations.