GCFA NTFS Artifact Analysis Practice Question
What is the consequence of a file name being stored in the $FILE_NAME attribute but not in the $INDEX_ROOT of its parent directory?
⚠ Common exam trap
Examinees often confuse 'orphaned' files with 'allocated' or 'resident' files, forgetting that missing parent directory index entries disconnect the file from the directory tree.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file is an orphaned file.
If a file name exists in the $FILE_NAME attribute but not in the parent directory's $INDEX_ROOT, the file is 'orphaned'. It remains present on the disk in the MFT but is invisible to the OS and users via standard directory navigation. This is a common indicator of a partially successful deletion or a file system error that removed the directory link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is encrypted with BitLocker.
Why it's wrong here
Encryption status is unrelated to directory indexing. A file can be encrypted and still be correctly indexed within its parent directory. Orphaned status is a structural condition of the NTFS directory B-tree and the MFT linkage, not a side effect of disk encryption or security policy implementation.
- ✗
The file is a system-hidden file.
Why it's wrong here
System-hidden files are still properly indexed in their parent directory, just marked with specific attributes to prevent user visibility. An orphaned file is not merely hidden; it is structurally disconnected from the filesystem's directory tree, making it inaccessible to the OS regardless of visibility settings.
- ✓
The file is an orphaned file.
Why this is correct
A file is orphaned when its MFT record still exists, but the corresponding entry in the parent directory's index is missing or corrupted. This prevents the file from being visible in file explorers, making it a target for forensic recovery as it is essentially 'lost' to the OS.
- ✗
The file is a compressed sparse file.
Why it's wrong here
Compression and sparseness are properties of how data is stored on the disk, not how the file is cataloged in the directory. Both compressed and sparse files are fully indexed in their parent directory B-trees, meaning this status cannot be the cause of an orphan condition.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.