GCFA NTFS Artifact Analysis Practice Question
An analyst is examining an NTFS volume and finds that a file's $DATA attribute is resident. The file size is 800 bytes. The analyst attempts to recover the file content using a tool that only reads the data runs from the MFT record. What will be the outcome of this recovery attempt?
⚠ Common exam trap
The trap here is assuming that all file data is stored in data runs, ignoring the fact that small files can have resident $DATA attributes where content is embedded in the MFT record.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The tool will fail to recover the file content because it does not parse the resident data within the MFT record.
Resident $DATA attributes store file content directly within the MFT record, not in separate clusters. A tool that only reads data runs is designed for non-resident attributes and will not extract resident data. Therefore, the recovery attempt will fail because the tool does not parse the resident data. The content remains in the MFT record but is inaccessible to this tool.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The tool will recover only the first 800 bytes from the data runs, which are partially resident.
Why it's wrong here
Resident attributes do not have data runs; they are entirely contained in the MFT record. There is no concept of partial residency. The file content is either resident or non-resident. Therefore, this outcome is impossible. The tool will not find any data runs for this file, and thus cannot recover any part of the content.
- ✗
The tool will successfully recover the file content because the data is stored in the MFT record.
Why it's wrong here
A tool that only reads data runs will not recover resident data because resident data is not stored in data runs. Data runs are used for non-resident attributes. Therefore, this tool would fail to recover the content, even though the data is present in the MFT record. The tool's method is incompatible with resident attributes.
- ✓
The tool will fail to recover the file content because it does not parse the resident data within the MFT record.
Why this is correct
Resident $DATA attributes store the file content directly within the MFT record, not in separate clusters. A tool that only reads data runs is designed for non-resident attributes and will not extract resident data. Thus, the recovery attempt will fail because the tool does not parse the resident data. The content remains in the MFT record but is inaccessible to this tool.
- ✗
The tool will recover the file content from the $ATTRIBUTE_LIST if the resident data overflows the MFT record.
Why it's wrong here
The $ATTRIBUTE_LIST is used when attributes do not fit in a single MFT record, but resident data is stored within the attribute itself. If the file size is 800 bytes, it fits within the typical MFT record size (1024 bytes), so it is resident and does not require an $ATTRIBUTE_LIST. The tool would not recover the data from $ATTRIBUTE_LIST because the data is not stored there.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.