The first 5 bytes (characters) for all MFT records are FILE.

• A. True
• B. The first 4 bytes are FILE
• C. The first 6 bytes are FILE
• D. False

Answer: (D)

In NTFS, each MFT record starts with a four-byte ASCII signature "FILE" that marks it as a master file table entry. The fifth byte is not part of this signature; it belongs to the next header fields (such as the update sequence array information) and is not the letter "F" again. So claiming that the first five bytes are FILE is incorrect—the signature is exactly four bytes long, after which other header data begins.