GCFA NTFS Artifact Analysis Practice Question
A forensic analyst is reviewing an NTFS volume and notices that a particular MFT record has an $ATTRIBUTE_LIST attribute. The analyst wants to understand why this attribute is present. Which of the following best describes the purpose of the $ATTRIBUTE_LIST attribute in an MFT record?
⚠ Common exam trap
Candidates often confuse the $ATTRIBUTE_LIST with attributes that store data runs or security information, when it actually serves as an index for locating attributes across MFT records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It provides a mapping of all attributes and their locations when they do not fit in the base MFT record.
The $ATTRIBUTE_LIST attribute is present when a file's attributes cannot all fit in the base MFT record. It lists each attribute and specifies whether it is resident in the base record or in an extension record, along with the MFT reference of that extension record. This allows NTFS to locate all attributes. The other options describe functions of other attributes or metadata files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It stores the security descriptor for the file to control access permissions.
Why it's wrong here
The security descriptor for a file is stored in the $SECURITY_DESCRIPTOR attribute, not in the $ATTRIBUTE_LIST. The $ATTRIBUTE_LIST does not contain access control information. Its role is purely organizational, mapping attributes when they span multiple MFT records. Security descriptors are separate and are often stored in the $Secure metadata file.
- ✗
It lists the data runs for the $DATA attribute when the file is fragmented.
Why it's wrong here
The $ATTRIBUTE_LIST does not list data runs. Data runs for the $DATA attribute are stored in the $DATA attribute itself, either resident or non-resident. The $ATTRIBUTE_LIST is used when attributes cannot fit in the base MFT record, not for fragmentation. Fragmentation is handled within the data runs, not by the $ATTRIBUTE_LIST.
- ✗
It tracks the change journal entries for the file for auditing purposes.
Why it's wrong here
Change journal entries are stored in the $UsnJrnl metadata file, not in the $ATTRIBUTE_LIST. The $ATTRIBUTE_LIST does not track changes or auditing information. Its function is to list attributes and their locations when they cannot all fit in the base MFT record. It is not related to the USN journal or auditing.
- ✓
It provides a mapping of all attributes and their locations when they do not fit in the base MFT record.
Why this is correct
The $ATTRIBUTE_LIST attribute is used when a file has many attributes or large attributes that cannot fit in the base MFT record. It lists the attributes and indicates whether they are resident in the base record or in an extension MFT record. This allows NTFS to locate all attributes of a file across multiple MFT records.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.