GCFA NTFS Artifact Analysis Practice Question
Which attribute is used to store the location and length of file data runs in an NTFS MFT record?
⚠ Common exam trap
Candidates frequently confuse the $DATA attribute with $STANDARD_INFORMATION or $FILE_NAME when asked where non-resident file data runs and cluster locations are stored.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$DATA
The $DATA attribute is responsible for storing the file's content or references to the clusters where the data resides on the disk. When the file is too large to be resident, the $DATA attribute contains 'data runs'—compacted descriptions of the starting cluster and the number of consecutive clusters allocated to the file, which the driver uses to read the file data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$FILE_NAME
Why it's wrong here
$FILE_NAME is used for storing the file's name, parent directory ID, and temporal attributes. It does not contain information about the physical location of the file's data blocks on the disk. Storing data runs here would violate the separation of metadata and data content in the MFT.
- ✓
$DATA
Why this is correct
$DATA contains either the data itself (if resident) or the data runs (if non-resident). Data runs provide the logical-to-physical mapping required for the OS to retrieve file data from the disk clusters. This is the core attribute for mapping file content to disk-level storage locations.
- ✗
$INDEX_ROOT
Why it's wrong here
$INDEX_ROOT is used in directory MFT records to store the root of the B-tree containing the directory's contents. It is not involved in storing data runs for files, as it is specialized for indexing file names and metadata within a directory entry to facilitate efficient file lookups.
- ✗
$ATTRIBUTE_LIST
Why it's wrong here
$ATTRIBUTE_LIST is used only when an MFT record is too full to hold all its attributes, forcing them to overflow into other records. It acts as an index to those other records, not as a storage location for the data runs of the file's actual content.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.