GCFA NTFS Artifact Analysis Practice Question
An analyst is examining an NTFS volume and finds that a file's $DATA attribute is non-resident, but the file size reported by the operating system is 0 bytes. The analyst suspects the file may have been involved in a data hiding technique. Which of the following is the most likely explanation for this discrepancy?
⚠ Common exam trap
The trap here is assuming that a 0-byte file size means no data exists, when in fact allocated clusters may still contain hidden data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file's $DATA attribute has a logical size of 0 but still has allocated clusters, indicating possible slack space or hidden data.
A non-resident $DATA attribute with a logical size of 0 but allocated clusters is a classic sign of data hiding. An attacker can write data to a file, then truncate the file's logical size to 0 without deallocating the clusters, leaving the data intact in the allocated clusters. Forensic tools can parse the data runs and recover the hidden content. This technique is often used to conceal data on NTFS volumes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is a sparse file, and the 0-byte size indicates that all its data is stored in sparse regions.
Why it's wrong here
Sparse files can have a logical size greater than zero while having unallocated regions. A 0-byte file size with a non-resident $DATA attribute is not typical for sparse files; sparse files usually report their logical size, which would be non-zero if there is any data. The scenario specifically mentions a 0-byte size, which is inconsistent with a sparse file that has content.
- ✗
The file's data runs point to clusters that have been marked as bad and are no longer accessible.
Why it's wrong here
If clusters were marked bad, the file system would typically report errors or the file would be inaccessible. The scenario states the file size is 0 bytes, which suggests the $DATA attribute exists but its logical size is zero. Bad clusters would not cause a non-resident $DATA attribute with zero size; they would affect data retrieval, not the metadata size.
- ✓
The file's $DATA attribute has a logical size of 0 but still has allocated clusters, indicating possible slack space or hidden data.
Why this is correct
In NTFS, a non-resident $DATA attribute can have a logical size of 0 while still having allocated clusters if the file was truncated or if data was written and then the size was reset without deallocating clusters. This can be used to hide data in allocated clusters that are not reflected in the file size. Forensic tools can examine the data runs to recover such hidden data.
- ✗
The $DATA attribute is corrupted, and the file system is reporting an incorrect size.
Why it's wrong here
While corruption can cause size discrepancies, the scenario describes a deliberate data hiding technique, and a non-resident $DATA attribute with zero logical size but allocated clusters is a known method for hiding data. Corruption is less likely given the context and would typically be accompanied by other file system errors. The most plausible explanation is intentional manipulation.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.