GCFA NTFS Artifact Analysis Practice Test 2 — 15 Questions

Question 1

An analyst is examining a Windows system and finds that a file named 'confidential.docx' has an MFT entry with a $STANDARD_INFORMATION attribute that includes a security ID. The analyst wants to determine which user account last accessed the file. Which NTFS artifact should the analyst examine to map the security ID to a user account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The $Secure metadata file, which contains the security descriptors and a mapping of security IDs to security descriptors.. The $STANDARD_INFORMATION attribute contains a security ID that indexes into the $Secure metadata file. $Secure stores unique security descriptors and provides indexes ($SII and $SDH) to look up the descriptor by security ID. The descriptor contains the owner SID, which can be resolved to a user account via the SAM or Active Directory.

Answer

The $MFT metadata file, which contains the security ID directly mapped to a username.

Answer

The $UsnJrnl metadata file, which records security ID changes for each file.

Answer

The $LogFile metadata file, which logs security descriptor changes and can be replayed to find the user.

Question 2

During an investigation of a compromised Windows server, an analyst extracts an MFT record and observes that the $DATA attribute is non-resident and the $ATTRIBUTE_LIST attribute is present. The analyst also notes that the MFT record contains a $BITMAP attribute. Which statement best describes the forensic implication of these attributes appearing together in a single MFT entry?

Accepted Answer

The MFT entry is an extension record that contains overflow attributes for a base record whose attributes could not fit in a single MFT entry.. In NTFS, a file with many attributes or large resident attributes uses $ATTRIBUTE_LIST to point to extension MFT records. These extension records can contain a $BITMAP attribute that tracks which records in the extension set are in use. The simultaneous presence of $ATTRIBUTE_LIST, non-resident $DATA, and $BITMAP in one MFT entry indicates that the entry is an extension record rather than a simple base record for a directory, sparse file, or compressed file.

Answer

The MFT entry is a base record for a directory, and the $BITMAP attribute tracks which index entries are in use within the directory's $INDEX_ALLOCATION.

Answer

The MFT entry is a base record for a compressed file, and the $BITMAP attribute tracks which compression units have been successfully compressed.

Answer

The MFT entry is a base record for a sparse file, and the $BITMAP attribute tracks which clusters within the file are allocated versus sparse.

Question 3

A forensic analyst is examining an NTFS volume and wants to determine the original path of a file that has been moved to a different directory on the same volume. Which artifact provides the most reliable information about the file's original location?

Accepted Answer

The $FILE_NAME attribute of the MFT entry, which stores the parent directory reference and the filename.. The $FILE_NAME attribute in the MFT entry contains the filename and a parent directory reference. When a file is moved within the same volume, this attribute is updated to reflect the new parent. However, if the file had multiple hard links or was renamed, multiple $FILE_NAME attributes may exist, preserving historical names and parent references. Thus, it is the most reliable artifact for determining original location, though it may require careful interpretation.

Answer

The $OBJECT_ID attribute, which stores a unique identifier that can be linked to the file's original path via the $ObjId index.

Answer

The $STANDARD_INFORMATION attribute, which records the file's creation, modification, and access timestamps.

Answer

The $INDEX_ROOT attribute, which contains the directory index for the file's current parent directory.

Question 4

During an investigation, an analyst discovers that a file's $STANDARD_INFORMATION attribute has a timestamp with a value that is not a valid NTFS timestamp (e.g., year 1601). What is the most likely cause of this anomaly?

Accepted Answer

The file's timestamp was manually set using a tool that allows arbitrary values, a technique known as timestomping.. An NTFS timestamp of year 1601 is the zero value of the FILETIME structure, which is not a valid time for a real file. This anomaly is typically caused by timestomping tools that allow setting arbitrary timestamps, or by deliberate corruption. It is a red flag for anti-forensic activity, and analysts should compare with $FILE_NAME timestamps to corroborate.

Answer

The file was created on a FAT file system and later converted to NTFS, which preserved the invalid timestamp.

Answer

The file was accessed by a legacy application that does not support modern timestamps, causing NTFS to revert to the epoch.

Answer

The file is a system file, and NTFS uses a special timestamp format for system files that can include year 1601.

Question 5

An investigator is analyzing a Windows system and notices that a file's $STANDARD_INFORMATION timestamps show a creation date of 2020, while the $FILE_NAME timestamps show a creation date of 2023. The file's content appears to be from 2023. The investigator suspects timestomping. Which NTFS artifact should be examined to corroborate the true creation time by looking at when the file's MFT record was last modified?

Accepted Answer

The $LogFile transaction records for the MFT record. The $LogFile is a transactional log that records metadata changes to NTFS structures, including MFT record updates. If timestomping altered $STANDARD_INFORMATION timestamps, the $LogFile may still contain records showing when the MFT record was actually modified. This can corroborate the true creation time. The other options are either part of the manipulable $STANDARD_INFORMATION or do not directly record MFT record modification.

Answer

The $MFT record's $STANDARD_INFORMATION attribute change time

Answer

The $MFT record's $STANDARD_INFORMATION MFT entry modified time

Answer

The $FILE_NAME attribute's creation timestamp

Question 6

An investigator is analyzing a Windows 10 system and finds that a file's $STANDARD_INFORMATION timestamps were modified to appear older than they actually are. The investigator suspects the use of a timestomping tool. Which NTFS artifact can provide evidence of the original timestamps by recording the time when the file's MFT record was last written to disk?

Accepted Answer

The $LogFile transaction records for the MFT record. The $LogFile is a transactional log that records metadata changes to NTFS structures, including MFT record updates. When timestomping modifies a file's timestamps, the MFT record is updated, and the $LogFile captures this event with a timestamp. This can provide evidence of the original timestamps or at least the time of modification. The other options are either part of the manipulable $STANDARD_INFORMATION or do not directly record MFT record writes.

Answer

The $UsnJrnl:$J alternate data stream

Answer

The $STANDARD_INFORMATION attribute's MFT entry modified time

Answer

The $FILE_NAME attribute's timestamps

Question 7

An analyst discovers a file with a non-zero size but no data in the $DATA attribute. Where is the file content likely located?

Accepted Answer

The MFT record. In NTFS, small files are stored directly within the Master File Table (MFT) record as resident data. This is an optimization to save cluster space and reduce disk I/O. When the data attribute is resident, the content is part of the MFT entry itself, which is critical for investigators to understand when carving data, as standard file-based recovery tools might overlook these resident segments during deep analysis.

Answer

The $LogFile

Answer

The $Bitmap

Answer

The $Extend folder

Question 8

Which NTFS metadata file serves as the index for all files and directories on the volume?

Accepted Answer

$MFT. The Master File Table (MFT) is the central database of an NTFS volume. Every file and directory on the disk has at least one entry in the MFT. Understanding the MFT is the foundation of NTFS forensics, as it contains all the metadata necessary to identify file properties, permissions, and data locations, which are essential for rebuilding the state of the filesystem during an investigation.

Answer

$LogFile

Answer

$Boot

Answer

$Volume

Question 9

What is the primary function of the $ATTRIBUTE_LIST attribute in an MFT entry?

Accepted Answer

To reference attributes stored in other MFT records.. The $ATTRIBUTE_LIST attribute is used when an MFT record is too small to hold all of a file's attributes. By storing a list of references to other MFT records, NTFS allows a single file to span multiple records. This is a crucial concept for analysts because it means that critical evidence, such as timestamps or data runs, might be hidden in secondary MFT records outside the primary entry.

Answer

To index directory contents.

Answer

To store extended file permissions.

Answer

To track file deletion history.

Question 10

What is the primary advantage of the $UsnJrnl over the $LogFile for long-term forensic analysis?

Accepted Answer

It has a much longer retention period.. The $UsnJrnl (Update Sequence Number Journal) is designed to track changes to files and directories over a long period. Unlike the $LogFile, which is a circular, short-term buffer for atomicity and recovery, the $UsnJrnl maintains a more persistent record of file activity. This makes it an invaluable source of historical metadata for investigators tracking how files were modified, created, or deleted over weeks or months.

Answer

It stores full file content for every transaction.

Answer

It is not volatile and survives power loss.

Answer

It contains the actual NTFS security descriptors.

Question 11

What is the primary role of the $MFTMirr file in NTFS?

Accepted Answer

To provide a backup of the first MFT records.. The $MFTMirr file contains a backup of the first few records of the Master File Table. This is vital for filesystem recovery if the primary MFT record gets corrupted. For forensic analysts, the $MFTMirr provides a fail-safe that confirms the structure of the MFT and can sometimes contain remnants of file metadata that are useful when the primary MFT record has been damaged or maliciously altered.

Answer

To mirror all file contents.

Answer

To index all files in the system.

Answer

To store encrypted file keys.

Question 12

What does a non-resident $DATA attribute indicate in an NTFS MFT record?

Accepted Answer

The file data is stored in separate clusters.. A non-resident $DATA attribute indicates that the actual file content is stored in external data clusters on the disk, rather than inside the MFT record. This is the standard behavior for most files. Analysts must understand this to correctly use data runs, which are pointers found within the $DATA attribute that tell the OS exactly where to find the file's fragmented pieces on the physical media.

Answer

The file is too small to be resident.

Answer

The file is corrupted.

Answer

The file is permanently deleted.

Question 13

What is the primary purpose of the $LogFile in NTFS?

Accepted Answer

To prevent filesystem corruption.. The $LogFile is essential for maintaining NTFS consistency. It records all metadata changes before they are committed, allowing the system to recover from crashes by rolling back or completing interrupted operations. While the $LogFile is circular and does not store user data, its entries can often reveal the order of operations, helping an investigator reconstruct the sequence of events leading up to a system compromise.

Answer

To track user login history.

Answer

To store backup copies of files.

Answer

To record all file access logs.

Question 14

Which NTFS metadata attribute is responsible for storing Security Descriptors (ACLs)?

Accepted Answer

$SECURITY_DESCRIPTOR. The $SECURITY_DESCRIPTOR attribute contains the Access Control List (ACL) information for a file, which determines which users or groups can access it. Forensic analysts frequently examine this to identify if permissions have been modified to allow unauthorized access or if a sensitive file has had its permissions altered to hide it from standard administrative users on the system.

Answer

$FILE_NAME

Answer

$ATTRIBUTE_LIST

Answer

$DATA

Question 15

Which NTFS master file table (MFT) record contains metadata about the MFT itself?

Accepted Answer

MFT Record 0. In NTFS, the MFT is treated as a file, and its metadata is stored within its own entry. Record 0 is reserved specifically for the MFT. This recursive structure is fundamental to the NTFS architecture, allowing the system to locate the MFT at boot time and parse the rest of the file system efficiently during startup processes.

Answer

MFT Record 1

Answer

MFT Record 5

Answer

MFT Record 255