GCFA NTFS Artifact Analysis Practice Question
An investigator is analyzing an NTFS volume from a compromised server. A file named 'payroll.xlsx' appears in the directory listing, but the MFT record for that filename shows a zero-length $DATA attribute and no $OBJECT_ID. A separate MFT record with a different record number contains the same $FILE_NAME value, a large non-resident $DATA attribute, and an $OBJECT_ID. Which NTFS artifact best explains the presence of two MFT records referencing the same filename?
⚠ Common exam trap
The trap here is assuming that a filename uniquely identifies an MFT record, when in fact NTFS can retain stale records for deleted files that share names with active files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was deleted and later a new file with the same name was created, leaving a stale MFT record alongside the active one.
NTFS does not immediately clear MFT records when files are deleted; the record is marked unallocated but its contents may persist until reused. A subsequent file with the same name is assigned a new record number, producing two records with the same $FILE_NAME. The active record typically contains the live $DATA and an $OBJECT_ID, while the stale record may show remnants such as zero-length data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A hard link was created, so the original MFT record was repurposed while a new record was allocated for the additional filename reference.
Why it's wrong here
Hard links share a single MFT record and increment its link count; they do not create a second record with the same $FILE_NAME. While a file can have multiple $FILE_NAME attributes in one record, the presence of two separate record numbers with identical names is not how hard links manifest in NTFS metadata.
- ✗
The volume is part of a Distributed File System replica, and DFSR metadata duplicated the MFT record during replication.
Why it's wrong here
DFSR operates at the file level and replicates content between servers; it does not duplicate MFT records within a single NTFS volume. DFSR metadata is stored in a separate database and reparse points, not as duplicate MFT entries, so this cannot account for two records sharing a filename on the same volume.
- ✓
The file was deleted and later a new file with the same name was created, leaving a stale MFT record alongside the active one.
Why this is correct
When a file is deleted, its MFT record is marked inactive but not immediately wiped; a new file with the same name receives a different record number. The stale record may retain a zero-length $DATA or residual attributes, while the new record holds the active data and an $OBJECT_ID assigned at creation, explaining the duplicate filename across two records.
- ✗
The file was compressed, causing NTFS to create a shadow MFT record for the compressed data stream.
Why it's wrong here
NTFS compression is handled within the same MFT record by setting the compressed flag in the $DATA attribute header; it does not spawn a second MFT entry. A duplicate record with a full data stream and an $OBJECT_ID is not a compression artifact, and compression would not produce a zero-length $DATA in the original record.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.