GCFA NTFS Artifact Analysis Practice Test 3 — 15 Questions

Question 1

During a forensic analysis, you encounter a file with a 'resident' $DATA attribute. What does this mean for your data recovery process?

Accepted Answer

The file data is stored directly in the MFT record.. A resident $DATA attribute means the file content is stored directly within the MFT record rather than in external clusters. This is common for very small files. Because the data is already inside the MFT record, you do not need to parse data runs or follow cluster pointers to extract the file, significantly simplifying the recovery process for small configuration or text files.

Answer

The file is fragmented across multiple clusters.

Answer

The file is encrypted with EFS.

Answer

The file is hidden from standard Windows APIs.

Question 2

An analyst is examining the USN Journal. What is the primary purpose of this file in the context of NTFS forensic analysis?

Accepted Answer

Providing a history of file system changes.. The USN Journal ($UsnJrnl) provides a chronological log of all changes made to files and directories on an NTFS volume. For forensics, it is invaluable because it captures activity that may no longer be reflected in the current MFT, such as the creation and subsequent deletion of files, or directory renames, providing a persistent history of disk modifications for timeline reconstruction.

Answer

Storing encrypted file passwords.

Answer

Maintaining the B-tree structure of directories.

Answer

Tracking user login and logout sessions.

Question 3

Which attribute is used to store the location and length of file data runs in an NTFS MFT record?

Accepted Answer

$DATA. The $DATA attribute is responsible for storing the file's content or references to the clusters where the data resides on the disk. When the file is too large to be resident, the $DATA attribute contains 'data runs'—compacted descriptions of the starting cluster and the number of consecutive clusters allocated to the file, which the driver uses to read the file data.

Answer

$FILE_NAME

Answer

$INDEX_ROOT

Answer

$ATTRIBUTE_LIST

Question 4

What is the consequence of a file name being stored in the $FILE_NAME attribute but not in the $INDEX_ROOT of its parent directory?

Accepted Answer

The file is an orphaned file.. If a file name exists in the $FILE_NAME attribute but not in the parent directory's $INDEX_ROOT, the file is 'orphaned'. It remains present on the disk in the MFT but is invisible to the OS and users via standard directory navigation. This is a common indicator of a partially successful deletion or a file system error that removed the directory link.

Answer

The file is encrypted with BitLocker.

Answer

The file is a system-hidden file.

Answer

The file is a compressed sparse file.

Question 5

What is the significance of the $LogFile in NTFS when performing an investigation on a system that experienced a sudden power loss?

Accepted Answer

It records transaction metadata for crash recovery.. The $LogFile is a circular buffer that records metadata operations before they are finalized. When a system crashes or loses power, the NTFS driver uses the $LogFile upon reboot to replay or undo incomplete transactions, ensuring volume consistency. For investigators, it provides a window into the state of the filesystem immediately before the crash, potentially recovering records of files modified just before the power failure.

Answer

It stores user credentials for encrypted sessions.

Answer

It keeps a copy of all deleted file contents.

Answer

It is used by BitLocker to verify volume integrity.

Question 6

Which NTFS attribute would an investigator primarily examine to determine the parent directory of a specific file?

Accepted Answer

$FILE_NAME. The $FILE_NAME attribute contains the parent directory ID, which is a reference to the directory's record in the MFT. This attribute is essential for building a full path for a file. Because it is maintained by the system kernel, it is also highly reliable for verification against the user-visible paths provided by the $SI attribute, aiding in identifying path-based manipulation.

Answer

$STANDARD_INFORMATION

Answer

$DATA

Answer

$INDEX_ROOT

Question 7

An examiner images a Windows 10 workstation and notices that several user profile folders are out of order in the \$MFT when sorted by MFT record number, yet the $STANDARD_INFORMATION timestamps are consistent. The examiner suspects that entries were reordered or that records were freed and reused. Which NTFS artifact best supports determining whether MFT record numbers have been reassigned to different files over time?

Accepted Answer

The $MFT record's sequence number, because it increments each time the record is allocated to a new file. The sequence number in an MFT file record is the key indicator of record reuse. It increases each time the record is allocated to a new file, so a higher sequence number than expected suggests the original file was deleted and the record was reassigned. Timestamps and $Bitmap do not preserve this allocation history.

Answer

The $STANDARD_INFORMATION attribute timestamps, because they are updated on every file access

Answer

The volume's $Bitmap file, because it tracks the allocation status of every MFT record

Answer

The $FILE_NAME attribute timestamps, because they persist across record reuse

Question 8

A forensic analyst is reviewing a Windows 10 workstation suspected of unauthorized data staging. While parsing the Master File Table with a commercial forensic suite, the analyst observes that a suspicious .zip file's $STANDARD_INFORMATION timestamps differ from its $FILE_NAME timestamps by more than six months, and the $FILE_NAME timestamps are older. Which conclusion is most consistent with this artifact pattern?

Accepted Answer

The $STANDARD_INFORMATION timestamps were likely altered by a timestomping utility, while the $FILE_NAME timestamps retained the original values.. NTFS stores two independent timestamp sets per file: $STANDARD_INFORMATION, writable through normal APIs, and $FILE_NAME, set at creation and rename. Anti-forensic tools commonly change only the former, producing a divergence where $FILE_NAME timestamps are older. This pattern is a reliable indicator of timestomping and should prompt deeper timeline analysis.

Answer

The file was created on a different NTFS volume and later copied onto this workstation using a tool that preserves $FILE_NAME timestamps.

Answer

The file was accessed by a backup application that updates only $STANDARD_INFORMATION timestamps during incremental backups.

Answer

The file system is corrupt and the $FILE_NAME attribute should be treated as unreliable, so only the $STANDARD_INFORMATION timestamps should be used for the timeline.

Question 9

An analyst is examining an NTFS volume from a Windows Server 2019 system that was used as a file server. A file critical to the investigation is missing from the directory listing, but the analyst suspects the file was recently deleted and its MFT entry has not been overwritten. Which NTFS artifact should the analyst examine to recover the file's full path and name if the MFT entry is still intact?

Accepted Answer

$FILE_NAME attribute within the file's MFT record. The $FILE_NAME attribute in the MFT record contains the file's name and a reference to its parent directory's MFT entry. By parsing this attribute and then locating the parent MFT entry, an analyst can reconstruct the full path. Other artifacts like $Bitmap or $UsnJrnl may provide supporting information but do not directly contain the full path.

Answer

$UsnJrnl:$J stream

Answer

$INDEX_ROOT attribute of the parent directory

Answer

$Bitmap metadata file

Question 10

An investigator is analyzing an NTFS volume from a compromised server. A file named 'payroll.xlsx' appears in the directory listing, but the MFT record for that filename shows a zero-length $DATA attribute and no $OBJECT_ID. A separate MFT record with a different record number contains the same $FILE_NAME value, a large non-resident $DATA attribute, and an $OBJECT_ID. Which NTFS artifact best explains the presence of two MFT records referencing the same filename?

Accepted Answer

The file was deleted and later a new file with the same name was created, leaving a stale MFT record alongside the active one.. NTFS does not immediately clear MFT records when files are deleted; the record is marked unallocated but its contents may persist until reused. A subsequent file with the same name is assigned a new record number, producing two records with the same $FILE_NAME. The active record typically contains the live $DATA and an $OBJECT_ID, while the stale record may show remnants such as zero-length data.

Answer

A hard link was created, so the original MFT record was repurposed while a new record was allocated for the additional filename reference.

Answer

The volume is part of a Distributed File System replica, and DFSR metadata duplicated the MFT record during replication.

Answer

The file was compressed, causing NTFS to create a shadow MFT record for the compressed data stream.

Question 11

During an investigation, you recover a deleted file from an NTFS volume. The MFT entry for the file shows that the $DATA attribute is non-resident, and the data runs are still intact. However, the $BITMAP attribute of the MFT indicates that the MFT entry is marked as unallocated. What is the most accurate conclusion about the recoverability of the file's content?

Accepted Answer

The file content is likely recoverable, but you must check the $Bitmap metadata file to confirm the clusters are not reallocated.. When an MFT entry is unallocated, the file's data runs may still be present, but the clusters they point to could have been reallocated. The $Bitmap metadata file tracks which clusters are in use. To determine recoverability, the analyst must check whether the clusters are marked as free in $Bitmap. If free, the content can likely be recovered; if allocated, the content may be overwritten.

Answer

The file content is unrecoverable because the MFT entry is unallocated, which means the data runs are invalid.

Answer

The file content can be fully recovered because the data runs are intact and point to clusters that have not been overwritten.

Answer

The file content can be recovered only if the $LogFile contains a record of the file's deletion.

Question 12

A first responder is collecting volatile and non-volatile data from a running Windows Server 2019 system. The investigator needs to determine which user or process most recently renamed a specific file on an NTFS volume, but the $STANDARD_INFORMATION timestamps show only a modification time. Which NTFS artifact should the investigator query to find rename events that record the previous filename?

Accepted Answer

The $UsnJrnl:$J alternate data stream, which logs USN_RECORD entries including RENAME_OLD_NAME and RENAME_NEW_NAME reasons.. The USN change journal, stored in the $UsnJrnl:$J alternate data stream, records file system events with reason codes. RENAME_OLD_NAME and RENAME_NEW_NAME entries capture both the prior and current filenames along with a timestamp and the file reference number. This makes the USN journal the primary artifact for reconstructing rename activity on NTFS.

Answer

The $MFT's $FILE_NAME attribute, which stores a history of all previous names assigned to the file.

Answer

The $Secure:$SDS stream, which records security descriptor changes that occur during rename operations.

Answer

The $LogFile, which contains redo and undo records for all metadata transactions including filename changes.

Question 13

You are analyzing an NTFS volume and need to determine the original path and name of a file that has been moved to a different directory. The file's MFT entry contains multiple $FILE_NAME attributes. Which two of the following statements about $FILE_NAME attributes are correct? (Choose two.)

Accepted Answer

The $FILE_NAME attribute includes a namespace field that indicates whether the name is in the POSIX, Win32, or DOS namespace.. $FILE_NAME attributes represent hard links; each link has a parent directory reference pointing to the directory containing the link. The namespace field indicates the naming convention used. These attributes are always resident and their timestamps update on rename or move, not content modification. Multiple $FILE_NAME attributes therefore indicate multiple hard links, and their parent references help reconstruct directory structure.

Answer

The $FILE_NAME attribute stores the file's original path when the file was moved, and the parent directory reference points to the original directory.

Answer

The $FILE_NAME attribute is updated whenever the file's content is modified, reflecting the last modification time.

Answer

The $FILE_NAME attribute can be resident or non-resident depending on the length of the filename.

Question 14

A forensic analyst is reviewing an NTFS volume from a Windows 10 workstation. The analyst finds an MFT entry whose $STANDARD_INFORMATION attribute contains four timestamps that are all set to a date three years in the past, but the corresponding $FILE_NAME attribute timestamps show dates within the past week. The file's content matches a recently created document. Which conclusion is most strongly supported by this artifact discrepancy?

Accepted Answer

The $STANDARD_INFORMATION timestamps were deliberately altered by a timestomping tool, while the $FILE_NAME timestamps reflect the actual file system activity.. The $STANDARD_INFORMATION attribute is the primary target of timestomping tools because it is what most user-facing interfaces display. The $FILE_NAME attribute, which is indexed in the directory entry, is often left unchanged by such tools. A large discrepancy where $STANDARD_INFORMATION is backdated but $FILE_NAME reflects recent activity is a classic indicator of deliberate timestamp manipulation.

Answer

The file was copied from an external NTFS volume, which preserved the original $STANDARD_INFORMATION timestamps but updated the $FILE_NAME timestamps.

Answer

The volume was formatted with a non-default cluster size, which causes $STANDARD_INFORMATION and $FILE_NAME timestamps to be updated independently.

Answer

The file system journal was replayed after an unclean shutdown, causing the $STANDARD_INFORMATION timestamps to roll back while the $FILE_NAME timestamps were left intact.

Question 15

An investigator is analyzing an NTFS volume and finds that a file's $DATA attribute is non-resident and its data runs point to clusters that are currently allocated to a different file. The file's size is 10 KB. What is the most likely explanation for this situation?

Accepted Answer

The file's data runs are corrupt or the MFT entry is inconsistent, possibly due to disk corruption or deliberate manipulation.. A non-resident $DATA attribute with data runs pointing to clusters allocated to another file is an abnormal condition. Standard NTFS features like compression, sparse files, or encryption do not cause such overlap. This inconsistency suggests corruption or intentional manipulation, requiring further forensic examination to determine the cause and potential data recovery challenges.

Answer

The file is encrypted, and the data runs are stored in the $EFS attribute instead of $DATA.

Answer

The file is sparse, and the data runs include sparse ranges that map to clusters not physically allocated.

Answer

The file is compressed, and the data runs are stored in a separate $DATA attribute named $TXF_DATA.