GCFA NTFS Artifact Analysis Practice Question
An analyst discovers a file with a non-zero size but no data in the $DATA attribute. Where is the file content likely located?
⚠ Common exam trap
Candidates often assume the file must be corrupted or missing data, failing to recognize that small files can be stored 'resident' directly within the MFT record itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The MFT record
In NTFS, small files are stored directly within the Master File Table (MFT) record as resident data. This is an optimization to save cluster space and reduce disk I/O. When the data attribute is resident, the content is part of the MFT entry itself, which is critical for investigators to understand when carving data, as standard file-based recovery tools might overlook these resident segments during deep analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The $LogFile
Why it's wrong here
The $LogFile is a transaction log used for metadata integrity and recovery, not for storing actual file contents. It records changes made to the NTFS volume, allowing the file system to restore consistency after a system crash, but it does not house the primary resident data of user files.
- ✗
The $Bitmap
Why it's wrong here
The $Bitmap file tracks the allocation status of clusters on an NTFS volume, indicating which clusters are in use or free. It is a system metadata file that does not contain resident file data or any payload information for user-accessible files on the volume.
- ✓
The MFT record
Why this is correct
Resident files store their data directly within the MFT record structure when the file size is smaller than the remaining space in the record. This avoids allocating a cluster, effectively keeping the file content embedded within the MFT itself, which forensic analysts must extract directly from the MFT entry.
- ✗
The $Extend folder
Why it's wrong here
The $Extend folder contains various metadata files for advanced NTFS features like quotas, object IDs, and reparse points. It is not designed to hold resident file data, and attempting to find file content here would be a misunderstanding of the NTFS directory structure and metadata organization.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.