GCFA Windows Artifact Analysis Practice Question
Which of the following describes the correct function of the $MFT (Master File Table) in an NTFS-formatted Windows volume?
⚠ Common exam trap
Candidates often describe the MFT as the file data itself, rather than a metadata index, failing to distinguish between the file's contents and the record that describes the file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It holds the metadata for all files on the volume.
The MFT is the central database of an NTFS volume. It stores metadata for every file and directory on the disk, including file names, sizes, timestamps, and data runs. For forensic analysts, the MFT is the most important artifact, as it provides a comprehensive map of all files, including deleted ones, allowing for the reconstruction of the file system and identification of malicious files that were intentionally erased by an adversary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is an application log that tracks system crashes.
Why it's wrong here
The MFT is a file system structure, not an application log. System crash logs are stored in dump files (.dmp). Confusing these will lead to wasted effort searching for crash data in the file system structure, which contains file metadata instead of operational logs or event information.
- ✓
It holds the metadata for all files on the volume.
Why this is correct
The MFT acts as the central index of the NTFS file system. It contains critical metadata like timestamps and data pointers for every file. This is the foundation of digital forensic file analysis, enabling investigators to recover evidence of files, even after they have been deleted by users.
- ✗
It stores user credentials for encrypted files.
Why it's wrong here
MFT does not store credentials. Encryption keys are typically handled by the Windows Encrypting File System (EFS) or BitLocker, which manage encryption metadata differently. Searching the MFT for credentials is an incorrect approach that will fail to produce any useful evidence for cracking encrypted data.
- ✗
It is only used to store files larger than 1GB.
Why it's wrong here
The MFT stores metadata for all files regardless of size. Smaller files may even have their data stored directly within the MFT record itself. Assuming it only stores large files is a major misconception that causes analysts to overlook evidence about small malicious scripts or configuration files.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.