nerdexam
EC-Council

312-49 · Question #636

Which of the following is a non-zero data that an application allocates on a hard disk cluster in systems running on Windows OS?

The correct answer is B. Master File Table. In Windows NTFS, the Master File Table (MFT) is a special metadata structure that Windows allocates on disk and populates with non-zero data containing records for every file and directory on the volume. Unlike slack space (which contains remnant data passively left behind) or…

Submitted by javi_es· Apr 18, 2026Disk Forensics

Question

Which of the following is a non-zero data that an application allocates on a hard disk cluster in systems running on Windows OS?

Options

  • ASparse File
  • BMaster File Table
  • CMeta Block Group
  • DSlack Space

How the community answered

(29 responses)
  • B
    90% (26)
  • C
    7% (2)
  • D
    3% (1)

Explanation

In Windows NTFS, the Master File Table (MFT) is a special metadata structure that Windows allocates on disk and populates with non-zero data containing records for every file and directory on the volume. Unlike slack space (which contains remnant data passively left behind) or sparse files (which intentionally represent empty regions), the MFT is actively allocated and written by the OS and always contains meaningful, non-zero data describing file attributes, sizes, timestamps, and locations.

Topics

#NTFS#Master File Table#File Allocation#Windows OS

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice