GCFA NTFS Artifact Analysis Practice Question
Which NTFS master file table (MFT) record contains metadata about the MFT itself?
⚠ Common exam trap
Test-takers often guess record 1 or record 5, confusing the root directory or standard system files with the actual MFT metadata record itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MFT Record 0
In NTFS, the MFT is treated as a file, and its metadata is stored within its own entry. Record 0 is reserved specifically for the MFT. This recursive structure is fundamental to the NTFS architecture, allowing the system to locate the MFT at boot time and parse the rest of the file system efficiently during startup processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
MFT Record 0
Why this is correct
Record 0 is defined in the NTFS specification as the $MFT. It stores the metadata entries for the file system structure itself. This enables the operating system to bootstrap the driver and understand the layout of all subsequent files, directories, and internal system structures stored on the volume.
- ✗
MFT Record 1
Why it's wrong here
MFT Record 1 is designated for the $MFTMirr, which contains a backup of the first few records of the $MFT. It is not the primary record for the MFT itself. Using this for metadata lookups would result in incorrect references to the backup rather than the active system MFT.
- ✗
MFT Record 5
Why it's wrong here
MFT Record 5 is conventionally assigned to the root directory of the volume ($Root). It manages the top-level folder structure but does not contain the metadata for the MFT structure itself. Confusing this with the MFT root record is a common error in low-level NTFS structural parsing.
- ✗
MFT Record 255
Why it's wrong here
Record 255 is an arbitrary index in the MFT and holds no specific system-reserved function. NTFS uses the first 16 records for special system files (the $MFT, $MFTMirr, $LogFile, $Volume, etc.). Records beyond this range are typically allocated to user files and directories as the volume grows.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.