The MFT contains records with the following information

Question

Options

• AFile attributes
• BLocation of first file segment in the file chain
• CFile records for deleted files
• DAll of the above

• A
  6% (2)
• B
  3% (1)
• C
  11% (4)
• D
  80% (28)

Explanation

Option D is correct because the MFT (Master File Table) in NTFS is a comprehensive metadata database that genuinely contains all three elements listed. Each MFT record stores file attributes (A) such as timestamps, permissions, and file size in attribute headers within the record itself. The MFT also stores data run information (B) pointing to the location of the first (and subsequent) file segments on disk, which is how NTFS tracks fragmented files across the volume. Critically, when a file is deleted (C), its MFT record is merely flagged as available - the record data persists until that slot is reused, making deleted file recovery possible in forensic analysis.

Since A, B, and C are all individually true, none of them are wrong distractors - they are each correct but incomplete answers; only D captures the full picture.

Memory tip: Think of an MFT record as a "file's ID card" - it holds the file's vital stats (attributes), its home address (segment location), and even expired cards (deleted file records) remain in the filing cabinet until a new tenant needs the slot.

No community discussion yet for this question.