GIAC
GCFE · Question #138
Which Windows artifact is primarily used to store metadata about files, including the file creation and modification times?
The correct answer is B. Master File Table (MFT). See the full explanation below for the reasoning.
Question
Which Windows artifact is primarily used to store metadata about files, including the file creation and modification times?
Options
- ARegistry keys
- BMaster File Table (MFT)
- CEvent logs
- DIndex.dat
How the community answered
(45 responses)- A7% (3)
- B82% (37)
- C2% (1)
- D9% (4)
Community Discussion
No community discussion yet for this question.