CHFI Storage Forensics and File System Analysis Practice Question
During a forensic analysis of a Windows 10 system, an investigator needs to locate the Master File Table ($MFT) to analyze file metadata. Which file system structure contains the $MFT?
⚠ Common exam trap
Watch out — candidates often confuse the $MFT with other file system structures like the FAT (which tracks cluster chains) or assume it is a generic concept across all file systems, but EC-Council tests that the $MFT is exclusive to NTFS and is the primary source for file metadata in Windows forensics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NTFS volume's Master File Table
The $MFT is a core component of the NTFS file system, storing metadata for every file and directory on the volume. It is located in the NTFS volume's designated Master File Table area, not in any other file system structure. Option D correctly identifies this NTFS-specific structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ext4 superblock
Why it's wrong here
The ext4 superblock is a low-level structure used by the Linux ext4 filesystem, storing global filesystem parameters such as block size, total block/inode counts, and filesystem state. It does not contain records for individual files, and ext4 relies on inode tables to track metadata, not an $MFT. Since the suspect system is Windows 10, which typically uses NTFS, ext4's superblock has no role in forensic listing of files.
- ✗
FAT32's File Allocation Table
Why it's wrong here
FAT32's File Allocation Table (FAT) is a linked-list map of cluster chains that shows which clusters are allocated to which files, but it does not store file names, timestamps, or sizes; those live in separate 32-byte directory entries. Because there is no per-file table equivalent to NTFS's $MFT, parsing the FAT alone cannot identify deleted or existing file metadata the way the Master File Table can.
- ✗
HFS+ catalog file
Why it's wrong here
HFS+ is the Apple filesystem used on macOS, and its catalog file is a B-tree that records file and folder names, file IDs, and references to extents, but it is fundamentally different from the NTFS Master File Table. The catalog file organizes hierarchical directory metadata, not a flat array of fixed-size file records like $MFT. As the target is a Windows 10 system, HFS+ structures would not be the default container for the volume's file metadata.
- ✓
NTFS volume's Master File Table
Why this is correct
The $MFT is the Master File Table, the core structure of the NTFS filesystem, and it holds 1024-byte file records for every file and directory, including system metadata files. Each record contains attributes such as $STANDARD_INFORMATION (timestamps, flags), $FILE_NAME, and $DATA, which investigators parse to enumerate files, examine MAC times, and uncover deleted entries. Since Windows 10 defaults to NTFS, this is the structure an investigator should analyze to retrieve file metadata.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.