GCFA › File System Timeline Artifact Analysis
This GCFA domain covers reconstructing activity from file system metadata across NTFS and ext4. Candidates use fls, mactime, and $MFT parsing to interpret MACB timestamps, $STANDARD_INFORMATION versus $FILE_NAME discrepancies, and anti-forensic timestamp manipulation. Questions present artifact combinations and require correct interpretation of what each timestamp change implies about user or system activity.
GCFA File System Timeline Artifact Analysis — All 62 Questions
Every question in this domain with answers and detailed explanations.