Computer Hacking Forensic Investigator (CHFI v10) — Question 463

Which of the following is a database in which information about every file and directory on an NT File System (NTFS) volume is stored?

Answer options

• A. Volume Boot Record
• B. Master Boot Record
• C. GUID Partition Table
• D. Master File Table

Correct answer: D

Explanation

The Master File Table (MFT) is the correct answer as it holds the metadata for every file and directory on an NTFS volume. The Volume Boot Record contains information about the volume itself, the Master Boot Record is related to the disk partitioning scheme, and the GUID Partition Table is a newer partitioning method that does not store file system data.