nerdexam
GIAC

GCFA · Question #236

Which of the following tables is formed by NTFS file system to keep the track of files, to store metadata, and their location?

The correct answer is A. The Master File Table. NTFS uses the Master File Table (MFT) as its central database to record metadata and the location of every file and directory on a volume.

File System & Registry Forensics

Question

Which of the following tables is formed by NTFS file system to keep the track of files, to store metadata, and their location?

Options

  • AThe Master File Table
  • BThe System File Table
  • CThe Master Allocation Table
  • DThe File Allocation Table

How the community answered

(24 responses)
  • A
    79% (19)
  • B
    4% (1)
  • C
    4% (1)
  • D
    13% (3)

Why each option

NTFS uses the Master File Table (MFT) as its central database to record metadata and the location of every file and directory on a volume.

AThe Master File TableCorrect

The Master File Table (MFT) is the core data structure of the NTFS file system, containing at least one record for every file and directory on the volume. Each MFT record stores metadata such as file name, timestamps, permissions, and pointers to the actual data clusters on disk. NTFS reserves the first 16 MFT entries for special system files and uses the MFT to enable fast file lookup and integrity tracking.

BThe System File Table

The System File Table is not a structure used by NTFS; this term does not correspond to any standard NTFS or Windows file system component.

CThe Master Allocation Table

The Master Allocation Table does not exist as a defined NTFS structure; allocation tracking in NTFS is handled through the MFT and the $Bitmap metadata file.

DThe File Allocation Table

The File Allocation Table (FAT) is a separate, older file system type used by FAT12, FAT16, and FAT32 volumes, not by NTFS.

Concept tested: NTFS Master File Table structure and purpose

Source: https://learn.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview

Topics

#NTFS#Master File Table#file metadata#file system structure

Community Discussion

No community discussion yet for this question.

Full GCFA Practice