312-49V11 · Question #24
Theodore, a forensic expert, was tasked with investigating a cybercrime involving a Windows operating system running on NTFS. In the course of the investigation, he accessed and analyzed several…
The correct answer is D. $mft. This question directly maps to CHFI v11 objectives under Operating System Forensics, specifically NTFS file system analysis and metadata examination. In NTFS, the Master File Table (MFT) is the core metadata file that contains a record for every file and directory on the…
Question
Theodore, a forensic expert, was tasked with investigating a cybercrime involving a Windows operating system running on NTFS. In the course of the investigation, he accessed and analyzed several metadata files stored in the root directory of the file system. These metadata files maintain records for every file stored on the system, including information such as file names, sizes, timestamps, and location on disk. While examining these files, Theodore was able to discover crucial data that helped track malicious events linked to the cybercrime. Which of the following system files did Theodore access to retrieve these records?
Options
- A$volume
- B$logfile
- C$mftmirr
- D$mft
How the community answered
(20 responses)- A5% (1)
- B5% (1)
- C10% (2)
- D80% (16)
Explanation
This question directly maps to CHFI v11 objectives under Operating System Forensics, specifically NTFS file system analysis and metadata examination. In NTFS, the Master File Table (MFT) is the core metadata file that contains a record for every file and directory on the volume. CHFI v11 emphasizes that the $MFT is one of the most critical artifacts in Windows forensics because it stores essential attributes such as file names, file sizes, creation/modification/access timestamps, permissions, and the physical location of file data on disk. Each file on an NTFS volume has at least one corresponding MFT entry, making $MFT invaluable for reconstructing user activity, detecting deleted files, and correlating timelines during cybercrime investigations. Investigators often analyze the $MFT to uncover evidence of malicious file creation, modification, execution, or deletion--even when files have been removed from the file system view.
Topics
Community Discussion
No community discussion yet for this question.