Computer Hacking Forensic Investigator (CHFI v10) — Question 348

Where does Encase search to recover NTFS files and folders?

Answer options

• A. MBR
• B. MFT
• C. Slack space
• D. HAL

Correct answer: B

Explanation

The correct answer is B, MFT (Master File Table), as it contains information about all files and directories on an NTFS volume. The other options, such as MBR (A), Slack space (C), and HAL (D), do not hold the necessary file and folder metadata in the same way as the MFT does.