GCFA NTFS Artifact Analysis Practice Question
An analyst is examining an NTFS volume and finds a file named 'confidential.docx' in a directory. The file's MFT record shows that the $DATA attribute is resident. What does this indicate about the file's data storage, and what is the primary forensic implication?
⚠ Common exam trap
Candidates often confuse resident $DATA with non-resident $DATA, or assuming that resident data implies compression or encryption when it simply means the data fits in the MFT record.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file's content is stored entirely within the MFT record, and the analyst can recover it directly from the MFT without carving the disk.
A resident $DATA attribute indicates that the file's content is small enough to be stored directly within the MFT record. This means the analyst can recover the file content by parsing the MFT entry, without needing to locate clusters on disk. It is a simpler recovery scenario than non-resident data, which requires following data runs to clusters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file's content is encrypted with EFS, and the resident $DATA attribute stores the encryption keys.
Why it's wrong here
EFS-encrypted files use the $EFS attribute to store encryption metadata, and the file content itself is typically non-resident and encrypted. A resident $DATA attribute contains the actual file content, not encryption keys. EFS does not store keys in a resident $DATA attribute; it uses a separate $EFS attribute and user key material.
- ✓
The file's content is stored entirely within the MFT record, and the analyst can recover it directly from the MFT without carving the disk.
Why this is correct
A resident $DATA attribute means the file's content is small enough to fit within the MFT record, typically under approximately 700 bytes. The data is stored directly in the MFT entry, so the analyst can extract it by parsing the MFT record. This is a straightforward recovery because no cluster allocation or disk carving is required.
- ✗
The file's content is stored in clusters outside the MFT, and the analyst must use the data runs to locate it on disk.
Why it's wrong here
A non-resident $DATA attribute indicates content stored in clusters outside the MFT, with data runs pointing to those clusters. A resident $DATA attribute means the opposite: the content is small enough to be stored within the MFT record itself. Therefore, this option describes the non-resident case, not the resident case observed here.
- ✗
The file's content is compressed and stored in the MFT record, requiring decompression before analysis.
Why it's wrong here
Compressed files on NTFS use non-resident $DATA attributes with sparse runs and compression flags. Resident $DATA attributes are used for small, uncompressed data that fits in the MFT record. The presence of a resident $DATA attribute does not imply compression; it simply indicates small file size. Decompression is not required for resident data.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.