GCFA NTFS Artifact Analysis Practice Question
What is the primary role of the $MFTMirr file in NTFS?
⚠ Common exam trap
Students frequently mistake the $MFTMirr for a full backup of the entire filesystem rather than realizing it is specifically a safety copy of only the first few MFT records.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide a backup of the first MFT records.
The $MFTMirr file contains a backup of the first few records of the Master File Table. This is vital for filesystem recovery if the primary MFT record gets corrupted. For forensic analysts, the $MFTMirr provides a fail-safe that confirms the structure of the MFT and can sometimes contain remnants of file metadata that are useful when the primary MFT record has been damaged or maliciously altered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To mirror all file contents.
Why it's wrong here
The $MFTMirr only stores the first few records of the MFT, not the actual contents of the user files. Mirroring all file contents would require double the storage space of the entire partition, which is not feasible for a standard NTFS metadata recovery feature.
- ✗
To index all files in the system.
Why it's wrong here
The MFT itself is the index for all files in the system. The $MFTMirr exists only to protect the most essential records of that index, not to provide additional indexing capabilities or to serve as a general-purpose search index for files on the NTFS volume.
- ✓
To provide a backup of the first MFT records.
Why this is correct
The $MFTMirr file acts as a protective mechanism, storing a copy of the first few entries in the MFT. This allows the system to recover essential boot and file system metadata if the beginning of the MFT is corrupted, ensuring the volume remains accessible for basic operations.
- ✗
To store encrypted file keys.
Why it's wrong here
Encryption keys for the Encrypting File System (EFS) are stored in the user's profile and the system security database, not in the $MFTMirr. The $MFTMirr is strictly a structural recovery file and does not handle cryptographic material or sensitive user security credentials.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.