GCFA NTFS Artifact Analysis Practice Question
During a forensic analysis, you encounter a file with a 'resident' $DATA attribute. What does this mean for your data recovery process?
⚠ Common exam trap
Students frequently mistake resident attributes for compressed files or think they require external data runs and cluster mapping to extract the content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file data is stored directly in the MFT record.
A resident $DATA attribute means the file content is stored directly within the MFT record rather than in external clusters. This is common for very small files. Because the data is already inside the MFT record, you do not need to parse data runs or follow cluster pointers to extract the file, significantly simplifying the recovery process for small configuration or text files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is fragmented across multiple clusters.
Why it's wrong here
Resident files are never fragmented because they fit entirely within the 1024-byte MFT record. Fragmentation only occurs when files exceed the capacity of the MFT record or the available space in the current run, forcing the system to allocate non-contiguous clusters on the physical disk volume.
- ✓
The file data is stored directly in the MFT record.
Why this is correct
Resident data is stored within the MFT record itself, avoiding the need for cluster allocation. This is an optimization for small files (typically under 700-900 bytes). For forensic analysts, this means the file content is immediately available once the MFT record is parsed, without needing cluster map traversal.
- ✗
The file is encrypted with EFS.
Why it's wrong here
Resident data status is independent of EFS encryption. While an encrypted file could theoretically be resident if it were tiny, the two concepts describe different aspects of file management. EFS status is determined by the $DATA_DECRYPTED attribute or the presence of the $LOGGED_UTILITY_STREAM attribute.
- ✗
The file is hidden from standard Windows APIs.
Why it's wrong here
Resident files are not hidden; they are just stored differently for performance. They are fully visible to standard Windows APIs and user applications. The 'resident' property is purely an internal file system optimization to minimize I/O overhead and cluster allocation for small files, not a security or obfuscation feature.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.