EnCE File Systems & Artifact Examination 2

Question 1

In NTFS, which data structure stores the location and attributes of every file and folder on the volume?

Accepted Answer

Master File Table

Answer

The Master File Table (MFT) is the core NTFS structure containing a record for every file and directory, including their attributes and data run locations.

Question 2

What is the significance of MFT entry number 0 in NTFS?

Accepted Answer

It is the MFT itself ($MFT)

Answer

$MFT (entry 0) is the MFT's own metadata record, allowing NTFS to treat the MFT as a regular file for self-description.

Question 3

An examiner notices that a file's $STANDARD_INFORMATION timestamps differ from its $FILE_NAME timestamps. What does this most likely indicate?

Accepted Answer

Timestamp manipulation (timestomping)

Answer

Timestomping tools typically modify $STANDARD_INFORMATION timestamps but often leave $FILE_NAME timestamps unchanged, creating a detectable discrepancy.

Question 4

In FAT32, what is the maximum individual file size supported by the file system specification?

Accepted Answer

4 GB minus 1 byte

Answer

FAT32 uses a 32-bit file size field, capping individual file size at 4,294,967,295 bytes (4 GB − 1 byte).

Question 5

Which EnCase feature allows an examiner to view files that have been deleted but whose directory entries still exist in an NTFS volume?

Accepted Answer

Conditions filter on 'Is Deleted'

Answer

EnCase's Conditions filter can be set to 'Is Deleted = True' to surface files whose MFT records are marked as unallocated but retain recoverable metadata.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE File Systems & Artifact Examination 2