GCFA NTFS Artifact Analysis Practice Question
What does a non-resident $DATA attribute indicate in an NTFS MFT record?
⚠ Common exam trap
Candidates frequently confuse non-resident attributes with deleted files, assuming that non-resident status implies data loss or file corruption rather than standard storage in external clusters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file data is stored in separate clusters.
A non-resident $DATA attribute indicates that the actual file content is stored in external data clusters on the disk, rather than inside the MFT record. This is the standard behavior for most files. Analysts must understand this to correctly use data runs, which are pointers found within the $DATA attribute that tell the OS exactly where to find the file's fragmented pieces on the physical media.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is too small to be resident.
Why it's wrong here
Files that are small are typically resident, not non-resident. If a file is non-resident, it is usually large enough that it cannot fit within the remaining space of an MFT record, forcing the system to allocate external clusters to store the bulk of the file's data.
- ✓
The file data is stored in separate clusters.
Why this is correct
A non-resident attribute means the data is located outside the MFT record in physical data clusters. The attribute header contains 'data runs' that describe the starting cluster and the number of clusters occupied, which are essential for manual file carving and data reconstruction.
- ✗
The file is corrupted.
Why it's wrong here
Non-residency is a standard, intentional feature of NTFS designed to manage files of varying sizes. It does not indicate corruption. A file is only considered corrupted if the data runs are invalid or if the MFT record itself is improperly formatted or damaged.
- ✗
The file is permanently deleted.
Why it's wrong here
Non-residency is a property of how the file system stores data, regardless of whether the file is active or deleted. A deleted file can have a non-resident $DATA attribute, but that only indicates where the data used to reside before the entry was marked as unallocated.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.