EnCE File Systems & Artifact Examination 2 — Questions and Answers
Question 1: In NTFS, which data structure stores the location and attributes of every file and folder on the volume?
- Volume Boot Record
- Master File Table (Correct answer)
- File Allocation Table
- Index Allocation Buffer
Correct answer: Master File Table
The Master File Table (MFT) is the core NTFS structure containing a record for every file and directory, including their attributes and data run locations.
Question 2: What is the significance of MFT entry number 0 in NTFS?
- It represents the root directory
- It is the MFT itself ($MFT) (Correct answer)
- It holds the volume label
- It is reserved and always empty
Correct answer: It is the MFT itself ($MFT)
$MFT (entry 0) is the MFT's own metadata record, allowing NTFS to treat the MFT as a regular file for self-description.
Question 3: An examiner notices that a file's $STANDARD_INFORMATION timestamps differ from its $FILE_NAME timestamps. What does this most likely indicate?
- File system corruption
- The file was compressed
- Timestamp manipulation (timestomping) (Correct answer)
- The file resides in an alternate data stream
Correct answer: Timestamp manipulation (timestomping)
Timestomping tools typically modify $STANDARD_INFORMATION timestamps but often leave $FILE_NAME timestamps unchanged, creating a detectable discrepancy.
Question 4: In FAT32, what is the maximum individual file size supported by the file system specification?
- 2 GB
- 4 GB minus 1 byte (Correct answer)
- 8 GB
- 16 TB
Correct answer: 4 GB minus 1 byte
FAT32 uses a 32-bit file size field, capping individual file size at 4,294,967,295 bytes (4 GB − 1 byte).
Question 5: Which EnCase feature allows an examiner to view files that have been deleted but whose directory entries still exist in an NTFS volume?
- Physical Disk view
- Conditions filter on 'Is Deleted' (Correct answer)
- Logical Evidence File browser
- Hash library comparison
Correct answer: Conditions filter on 'Is Deleted'
EnCase's Conditions filter can be set to 'Is Deleted = True' to surface files whose MFT records are marked as unallocated but retain recoverable metadata.
Question 6: What does the $LogFile in NTFS record?
- Application event logs
- Metadata-level transaction history for crash recovery (Correct answer)
- User login events
- File content changes in plaintext
Correct answer: Metadata-level transaction history for crash recovery
$LogFile is an NTFS journal that records metadata transactions, enabling volume recovery after an unexpected shutdown — it does not log file content.
Question 7: On an exFAT volume, which structure replaces the traditional FAT directory entry to store file metadata?
- MFT Record
- Directory Entry Set with File and Stream Extension entries (Correct answer)
- Inode table
- Volume Descriptor
Correct answer: Directory Entry Set with File and Stream Extension entries
exFAT uses a Directory Entry Set consisting of a File entry, Stream Extension entry, and File Name entry to store metadata that would occupy a single FAT32 directory entry.
EnCE File Systems & Artifact Examination 2
In NTFS, which data structure stores the location and attributes of every file and folder on the volume?