GCFA NTFS Artifact Analysis Practice Question
An investigator is examining an NTFS volume from a system that was abruptly powered off during a malware installation. The analyst observes that the MFT contains a file record for a suspicious executable with a valid $DATA attribute, but the file is not visible in the directory index. Which NTFS artifact should the analyst examine to determine whether the file record was orphaned due to an interrupted transaction?
⚠ Common exam trap
The trap here is assuming the USN journal or $Bitmap can explain transaction interruption, when only $LogFile contains the redo/undo records needed to analyze incomplete metadata operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The $LogFile, which contains redo and undo records that can show incomplete metadata transactions from the power loss.
$LogFile is the NTFS write-ahead journal that ensures metadata consistency. It records redo and undo information for transactions. After an abrupt power loss, incomplete transactions may leave the MFT updated but the directory index not, producing an orphaned file record. Analyzing $LogFile can reveal the interrupted operation and help reconstruct the intended state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The $Secure:$SDS stream, which stores security descriptors and would show if the file's permissions were applied during creation.
Why it's wrong here
The $SDS stream contains security descriptors referenced by $SECURITY_DESCRIPTOR attributes. While a security descriptor may be present for the file, it does not indicate transaction completion or directory index consistency. It cannot reveal whether the file record was orphaned by an interrupted operation.
- ✗
The $UsnJrnl:$J, which records all file system changes and would show the file creation event even if the directory index was not updated.
Why it's wrong here
The USN journal records events after they are committed to the file system; if a transaction was interrupted before the directory index update, the corresponding USN record may not exist. While the journal can show prior activity, it does not contain the redo/undo transaction details needed to confirm an interrupted metadata operation.
- ✗
The $Bitmap, which tracks cluster allocation and would indicate whether the file's clusters were allocated before the power loss.
Why it's wrong here
$Bitmap shows cluster allocation state but does not record transaction history. It can confirm whether clusters are currently allocated, but it cannot explain why the MFT record exists without a directory entry or whether the transaction was interrupted, making it insufficient for this determination.
- ✓
The $LogFile, which contains redo and undo records that can show incomplete metadata transactions from the power loss.
Why this is correct
$LogFile is a write-ahead log that records metadata transactions before they are committed to the MFT. After a power loss, it can contain redo and undo records for incomplete operations, such as a file creation that updated the MFT but not the parent directory index. Examining $LogFile can reveal whether the orphaned record resulted from an interrupted transaction.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.