GCFA NTFS Artifact Analysis Practice Question
A forensic analyst is examining an NTFS volume and finds that a directory's $I30 index entries are present in the $INDEX_ROOT, but the $INDEX_ALLOCATION attribute is non-resident and points to INDX records. The analyst needs to determine whether a deleted file once existed in that directory. Which artifact should the analyst examine to find residual filename entries that may reference the deleted file?
⚠ Common exam trap
The trap here is assuming that deleted directory entries are completely erased and that only the $MFT can show deleted files, overlooking the residual data in INDX slack space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Slack space within the INDX records in the $INDEX_ALLOCATION
When a file is deleted from an NTFS directory, its entry in the $I30 index is removed, but remnants often persist in the slack space of INDX records within the $INDEX_ALLOCATION. These residual entries can contain the filename and file reference number, allowing an analyst to infer the existence of a deleted file. The $BITMAP, $LOGGED_UTILITY_STREAM, and $REPARSE_POINT attributes do not store filename entries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Slack space within the INDX records in the $INDEX_ALLOCATION
Why this is correct
INDX records in the $INDEX_ALLOCATION contain index entries and often retain stale or slack entries after a file is deleted. These residual entries can include the filename and file reference of a deleted file. Analyzing the slack space of these INDX records is a standard technique to recover evidence of deleted files from a directory index.
- ✗
The $REPARSE_POINT attribute in the directory's MFT record
Why it's wrong here
The $REPARSE_POINT attribute stores reparse data for junctions, symbolic links, or mount points. It does not hold directory index entries or filenames. Examining it would only reveal reparse behavior, not evidence of a deleted file. It is not a source for residual filename entries in an NTFS directory index.
- ✗
The $LOGGED_UTILITY_STREAM attribute of the directory
Why it's wrong here
The $LOGGED_UTILITY_STREAM attribute is used for EFS encryption metadata, not for directory index entries. It would not contain filenames of deleted files. While it can be relevant in encryption investigations, it does not serve as a repository for residual directory index information and is unrelated to recovering deleted filenames from an index.
- ✗
The $BITMAP attribute of the directory's MFT record
Why it's wrong here
The $BITMAP attribute in a directory's MFT record tracks which INDX records within the $INDEX_ALLOCATION are in use. It does not contain filename entries or residual names of deleted files. Examining it only tells the analyst which index buffers are allocated, not which filenames were previously indexed, so it cannot reveal a deleted file's presence.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.