312-49 · Question #188
Where does Encase search to recover NTFS files and folders?
The correct answer is B. MFT. EnCase, a leading digital forensics tool, searches the MFT (Master File Table) to recover NTFS files and folders. The MFT is a special metadata file in every NTFS volume that contains a record for every file and directory on the volume, including deleted entries. When a file is…
Question
Where does Encase search to recover NTFS files and folders?
Options
- AMBR
- BMFT
- CSlack space
- DHAL
How the community answered
(39 responses)- A8% (3)
- B87% (34)
- C3% (1)
- D3% (1)
Explanation
EnCase, a leading digital forensics tool, searches the MFT (Master File Table) to recover NTFS files and folders. The MFT is a special metadata file in every NTFS volume that contains a record for every file and directory on the volume, including deleted entries. When a file is deleted, its MFT record is marked as available but not immediately overwritten, allowing forensic tools like EnCase to locate and recover deleted files and their metadata. The MBR (Master Boot Record) stores partition information, slack space is unused space within file clusters, and HAL (Hardware Abstraction Layer) is an OS component - none of these are where NTFS file metadata is stored.
Topics
Community Discussion
No community discussion yet for this question.