In Windows, which component stores metadata about files and directories and can reflect deletions when files are removed?

In Windows, which component stores metadata about files and directories and can reflect deletions when files are removed?

• A. Page File
• B. Master File Table (MFT)
• C. Indexing Service
• D. Registry

Answer: (B)

In NTFS, the Master File Table is the central store for metadata about every file and directory. Each file or folder has a record in the MFT that holds important attributes—such as its name, size, timestamps, permissions, and where the actual data is located on disk. Because the MFT is the repository of this metadata, it is the primary place where Windows records state changes to the filesystem, including deletions. When a file is deleted, its MFT entry is marked as no longer in use and the directory reference to that file is removed; the entry itself may persist for a time until it’s overwritten, and the system’s change logs can record that deletion. This combination makes the MFT the best source for understanding what existed on the filesystem and when deletions occurred, which is why it’s essential in forensic analysis. The other components don’t serve this role. The Page File holds virtual memory contents, not file metadata. The Registry stores configuration and system settings, not per-file metadata. The Indexing Service builds and maintains a search index, not the fundamental metadata about each file and its deletion events.

In NTFS, the Master File Table is the central store for metadata about every file and directory. Each file or folder has a record in the MFT that holds important attributes—such as its name, size, timestamps, permissions, and where the actual data is located on disk. Because the MFT is the repository of this metadata, it is the primary place where Windows records state changes to the filesystem, including deletions. When a file is deleted, its MFT entry is marked as no longer in use and the directory reference to that file is removed; the entry itself may persist for a time until it’s overwritten, and the system’s change logs can record that deletion. This combination makes the MFT the best source for understanding what existed on the filesystem and when deletions occurred, which is why it’s essential in forensic analysis.

The other components don’t serve this role. The Page File holds virtual memory contents, not file metadata. The Registry stores configuration and system settings, not per-file metadata. The Indexing Service builds and maintains a search index, not the fundamental metadata about each file and its deletion events.