GCFA NTFS Artifact Analysis Practice Question
Which NTFS attribute would an investigator primarily examine to determine the parent directory of a specific file?
⚠ Common exam trap
Test-takers often incorrectly choose the $INDEX_ROOT or $STANDARD_INFORMATION attribute when asked to find the parent directory reference for a specific file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$FILE_NAME
The $FILE_NAME attribute contains the parent directory ID, which is a reference to the directory's record in the MFT. This attribute is essential for building a full path for a file. Because it is maintained by the system kernel, it is also highly reliable for verification against the user-visible paths provided by the $SI attribute, aiding in identifying path-based manipulation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$STANDARD_INFORMATION
Why it's wrong here
$STANDARD_INFORMATION focuses on file timestamps and flags. It does not contain the parent directory ID. Relying on $SI for directory structure information is incorrect because that attribute is designed to provide temporal and permission information, not the structural placement of the file within the filesystem hierarchy.
- ✓
$FILE_NAME
Why this is correct
$FILE_NAME stores the name of the file and, crucially, the reference ID of its parent directory. This allows the OS to construct the file path and navigate the directory tree. Analysts use this to verify the file's location and identify potential discrepancies with the user-provided path.
- ✗
$DATA
Why it's wrong here
$DATA stores the file content. It has no metadata regarding the file system structure or directory hierarchy. Attempting to locate directory information here is ineffective as the attribute serves only to store the file payload or data run pointers, not organizational metadata about the directory structure.
- ✗
$INDEX_ROOT
Why it's wrong here
$INDEX_ROOT stores the B-tree structure for directories, not the parent directory information for a file. While it manages files within a directory, the file's own metadata record must store the link back to the parent. This is a common point of confusion in NTFS architecture analysis.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.