CHFI Storage Forensics and File System Analysis Practice Question
A forensic analyst is examining a disk image and needs to identify the file system structure. She looks for the Master File Table ($MFT) to begin analysis. Which file system is she most likely dealing with?
⚠ Common exam trap
EC-CHFI often tests the misconception that $MFT is a generic file system structure, but it is exclusive to NTFS; candidates may confuse it with the FAT table or superblock equivalents in other file systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NTFS
The Master File Table ($MFT) is a core component of the NTFS file system, storing metadata about every file and directory on the volume. When a forensic analyst locates the $MFT, they are definitively working with an NTFS volume, as no other common file system uses this structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FAT32
Why it's wrong here
FAT32 organizes volumes with a File Allocation Table and a root directory region. File metadata such as timestamps and sizes are stored in 32-byte directory entries, and cluster chains are tracked via the FAT. Because $MFT is an NTFS master metadata structure, it would never appear as the primary metadata store in a FAT32 filesystem. So the presence of suspect's $MFT indicates NTFS, not FAT32.
- ✓
NTFS
Why this is correct
NTFS is the only common filesystem that uses a Master File Table ($MFT) as its core metadata repository. Each file and directory is represented by a file record in the $MFT with attributes such as $STANDARD_INFORMATION, $FILE_NAME, and $DATA. Forensic examiners often locate the $MFT entry to identify timestamps, file ownership, and data runs, making this the correct answer.
- ✗
HFS+
Why it's wrong here
HFS+ relies on a volume header, a Catalog B-tree, and an Extents Overflow B-tree to manage files and directories. In HFS+, file metadata like record ID and timestamps is held in catalog records, not in a centralized MFT table. As a result, the $MFT artifact is exclusive to NTFS and would not be found in an HFS+ image.
- ✗
ext4
Why it's wrong here
ext4 stores both metadata and content addressing through inodes, each with a unique inode number, allocated from a per-block-group inode table. A superblock and block group descriptors track the filesystem layout, but there is no $MFT or equivalent file-record database. The analyst's finding of an $MFT therefore rules out ext4, which relies on an inode-centric design.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.