GCFA File System Timeline Artifact Analysis — 30 Questions

Question 1

An analyst is investigating an NTFS volume and notices that a file's $STANDARD_INFORMATION attribute modified timestamp is significantly earlier than its $FILE_NAME attribute modified timestamp. What is the most likely cause of this discrepancy during a forensic examination?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was copied to a new location within the same volume, causing $FILE_NAME to update while $STANDARD_INFORMATION was preserved.. Timestamp discrepancies between $STANDARD_INFORMATION and $FILE_NAME frequently occur when a file is copied or moved within the same NTFS volume. The copy operation creates new metadata where the $FILE_NAME is updated to the current time, while the $STANDARD_INFORMATION may retain copied or modified values depending on the specific user-space tool utilized.

Answer

The file was modified by the operating system kernel during a routine defragmentation pass.

Answer

An automated antivirus scanner accessed the file and updated the access time without altering metadata.

Answer

The system clock was manually adjusted backward by an attacker attempting to conceal malicious activity.

Question 2

An analyst is investigating a suspected malware execution. They notice the MFT entry for 'svchost.exe' shows a file creation time that is earlier than the MFT record modification time. Which artifact-based technique should the analyst employ to determine if a timestomp occurred?

Accepted Answer

Compare Standard Information (SI) attributes with File Name (FN) attributes.. Comparing standard information (SI) attributes with file name (FN) attributes is critical in NTFS forensics. When a file is moved or copied, the FN attribute reflects the original creation time, whereas the SI attribute is easily manipulated by user-mode APIs. Discrepancies between these two timestamps are a hallmark indicator of timestomping. This matters because attackers frequently modify metadata to hide their activities within the file system hierarchy, requiring analysts to cross-reference multiple MFT attributes for integrity validation.

Answer

Analyze the USN Journal for log gaps.

Answer

Examine the INDX records for file deletion.

Answer

Calculate the file hash and query VirusTotal.

Question 3

Which TWO of the following artifacts provide the most reliable evidence for reconstructing file system access history during a timeline analysis?

Accepted Answer

Shell Items (LNK Files). The Shell Items (LNK files) and the USN Journal are essential because they capture specific events rather than just static metadata. LNK files track user interaction and file paths, while the USN Journal provides a chronological log of file system changes. Relying on these prevents reliance on malleable metadata that attackers often exploit. Accurate timeline reconstruction requires correlation between user activity and underlying file system changes to prove specific malicious actions occurred.

Answer

MFT File Creation Timestamp

Answer

Registry 'LastWrite' times

Answer

File metadata (SI 'Modified' time)

Question 4

Refer to the exhibit. Based on the provided MFT attributes, what is the most likely conclusion regarding this file?

Accepted Answer

The file was timestomped to appear older than it is.. The exhibit shows a scenario where the SI creation time is earlier than the FN creation time. In standard Windows file operations, the FN attribute should be identical to or older than the SI attribute because FN is created during the file's birth. If SI is older than FN, it implies that the SI attribute was likely manually modified by an attacker, effectively 'timestomping' the file to predate its actual existence on the disk.

Answer

The file was moved from an NTFS partition to FAT32.

Answer

The file system encountered a cluster allocation error.

Answer

The operating system auto-updated the file metadata.

Question 5

When conducting a timeline analysis, which artifact is considered the most reliable source for determining when a file was actually deleted from an NTFS volume?

Accepted Answer

The $UsnJrnl (Update Sequence Number Journal).. The $LogFile and the $UsnJrnl are the primary sources for deletion events. While the MFT entry itself might be marked as free, the journal records contain transaction history that explicitly logs the deletion operation. Identifying the exact moment of deletion is critical for establishing a temporal boundary for attacker activities and determining what files were present during a specific window of time.

Answer

The MFT record's 'Deleted' flag.

Answer

The Recycle Bin's INFO2/index file.

Answer

Windows Event Log ID 4660.

Question 6

An analyst discovers a file with a 'Last Accessed' time that is significantly earlier than its 'Creation' time. What is the most appropriate forensic interpretation of this observation?

Accepted Answer

The file is a result of MFT record reuse.. In NTFS, the 'Last Accessed' time is often updated by search indexers, antivirus scanners, or anti-forensic tools. If the access time is earlier than the creation time, it suggests the MFT record was either timestomped or the record was reused by the OS for a new file while retaining remnants of the previous file's metadata in the access field. This is a common phenomenon that analysts must recognize to avoid misinterpreting file age.

Answer

The system clock was synchronized incorrectly.

Answer

An attacker manually changed the creation time.

Answer

The file was copied from an external drive.

Question 7

Which THREE of the following artifacts are commonly utilized to corroborate file system activity in a timeline analysis?

Accepted Answer

Prefetch Files. Correlation is the cornerstone of effective timeline analysis. By combining MFT records, event logs, and prefetch files, an analyst can verify if a file was merely present on the disk or if it was actively executed by a user or process. This triangulation mitigates the risk of relying on single, potentially manipulated data points, ensuring a robust and defensible reconstruction of events that transpired on the host.

Answer

BIOS/UEFI Time Settings

Answer

Volume Shadow Copies

Question 8

During a deep dive into an NTFS volume, you encounter a file where the $SI creation time is later than the $SI modification time. What does this indicate?

Accepted Answer

The file was likely moved or renamed.. This condition is often referred to as a 'birth-after-death' anomaly. It occurs when a file is moved within the same partition or modified in a way that causes the kernel to update the modification time but not the creation time, or vice-versa. Understanding these logical quirks is essential for forensic analysts to avoid incorrectly flagging benign system behaviors as malicious tampering or timestomping, which is common in complex NTFS environments.

Answer

The file has been actively timestomped.

Answer

The file is corrupted or fragmented.

Answer

The system clock was reset during an update.

Question 9

Which artifact is most useful for identifying the 'User' account associated with the creation of a specific file on a Windows system?

Accepted Answer

Security Event Logs (4624/4672).. Identifying the actor is just as important as identifying the action. Windows does not store the 'owner' in the MFT metadata in a way that tracks the creator's identity directly. Instead, analysts must correlate file creation times with security event logs (specifically Logon/Logoff events) or shell artifacts. This allows the investigator to map the file creation timestamp to a specific authenticated user session, which is necessary for attributing malicious actions to a specific threat actor.

Answer

The MFT File Owner SID.

Answer

The $LogFile transaction history.

Answer

The file's 'Last Accessed' time.

Question 10

When analyzing the $MFT, what is the significance of an entry having a sequence number of 1?

Accepted Answer

The MFT record has been reused once.. The sequence number in an MFT entry is incremented whenever a file record is reused. A sequence number of 1 indicates the record has been used very few times, suggesting a recently created file or a system that has not experienced significant file creation/deletion churn. This helps in understanding the lifespan of the file and whether the record is likely to have been recycled, which is crucial for determining the reliability of the metadata.

Answer

The file is a system-reserved protected file.

Answer

The file has been flagged for deletion.

Answer

The file is stored in a hidden directory.

Question 11

Which of the following describes the purpose of the 'Standard Information' (SI) attribute in an NTFS MFT record?

Accepted Answer

To record the timestamps used by the OS shell.. The SI attribute is the primary location for file timestamps visible to users and operating system applications. Because it is exposed to user-mode APIs, it is the most common target for attackers performing timestomping. Forensic analysts must understand that while SI is convenient for quick analysis, it is not the authoritative source for file events, as the File Name (FN) attribute serves as a more robust, kernel-level verification point for temporal data.

Answer

To store the file's actual data contents.

Answer

To define the security access control list.

Answer

To manage the file's compression status.

Question 12

During an NTFS file system timeline analysis using Sleuth Kit tools, an analyst observes multiple entries where the $MFT record's link count dropped to zero, yet data runs remain allocated. Which TWO file system phenomena or actions could produce this specific timeline artifact pattern?

Accepted Answer

A process has an open handle to the file while an unlinking operation occurred, delaying full cluster deallocation until the handle is closed.. Understanding how NTFS handles file deletion and hard links is vital for uncovering hidden data. When link counts hit zero without immediate cluster deallocation, it usually points to open file handles preventing deletion completion or specialized forensic scenarios. Recognizing these artifacts prevents analysts from missing active evidence residing in unlinked yet un-freed MFT records.

Answer

The file system underwent a routine check via chkdsk, which orphaned the file record and moved its extents to the Found.000 directory structure.

Answer

The file was subjected to aggressive zero-fill wiping, which explicitly clears the link count field before overwriting the allocated data clusters.

Answer

The file system journal ($USNJRNL) recorded an unexpected volume dismount while transaction logging was actively processing an incremental backup.

Question 13

When constructing a filesystem timeline on a Linux EXT4 system, which artifact is the most reliable indicator of file metadata modification (mtime) versus status change time (ctime)?

Accepted Answer

The ctime (change time) field.. In EXT4, the ctime (change time) records the last time the inode was modified, including changes to permissions, ownership, or links, which cannot be easily backdated. The mtime (modification time) reflects content changes. Understanding this distinction is crucial because attackers can easily reset mtime using the 'touch' command, but they cannot manipulate ctime without kernel-level access or modifying the system clock during the event.

Answer

The atime (access time) field.

Answer

The dtime (deletion time) field.

Answer

The file birth time (crtime) field.

Question 14

Which TWO of the following actions typically result in a modification of the $Standard_Information attribute in an NTFS filesystem?

Accepted Answer

Writing new data to an existing file.. The $Standard_Information attribute contains the MACB (Modified, Accessed, Changed, Birth) timestamps visible to standard Windows APIs. Any action that alters the file's content or fundamental file system status will trigger an update to this attribute. Knowing which actions trigger these updates allows investigators to reconstruct user activity and identify evidence of file access or tampering during the timeline analysis phase.

Answer

Renaming a file within the same directory.

Answer

Reading a file using a preview pane.

Answer

Moving a file to a different folder on the same volume.

Question 15

Based on the MFT exhibit, what conclusion can the forensic analyst draw about the file?

Accepted Answer

The file has been subjected to anti-forensic timestomping.. The exhibit shows a clear timestamp discrepancy between the $Standard_Information and $File_Name attributes. In NTFS, the $File_Name attribute is updated by the system kernel, while $Standard_Information is easily reachable by user-space applications. When the $Standard_Information times are perfectly rounded to the second and are earlier than the $File_Name times, it is a high-confidence indicator of timestamp manipulation performed by a tool attempting to hide the file's activity.

Answer

The file system is corrupted and requires a chkdsk fix.

Answer

The file was created on a different operating system.

Answer

The file was moved from a FAT32 partition to NTFS.

Question 16

A forensic analyst is reviewing an NTFS $MFT extracted from a compromised server. For one suspicious executable, the $STANDARD_INFORMATION timestamps show creation and modification in 2019, but the $FILE_NAME timestamps show creation and modification in 2022. The system clock was verified as accurate throughout. Which conclusion is BEST supported by this discrepancy?

Accepted Answer

The file was likely copied or restored onto the volume in 2022, causing NTFS to set new $FILE_NAME timestamps while the $STANDARD_INFORMATION timestamps were preserved from the original source.. When $STANDARD_INFORMATION timestamps predate $FILE_NAME timestamps by years on an accurately clocked system, the pattern commonly indicates a copy, restore, or timestomping operation where older metadata was preserved or set while NTFS wrote fresh $FILE_NAME values on this volume. Analysts should correlate with other artifacts before concluding, but the 2022 $FILE_NAME dates are more consistent with when the entry was placed here.

Answer

The file's $STANDARD_INFORMATION timestamps are unreliable because they are stored in the index, while $FILE_NAME timestamps are authoritative for the file itself.

Answer

The discrepancy is normal because NTFS updates $FILE_NAME timestamps only during volume mount operations, so the later dates reflect the last mount.

Answer

The file was compressed in 2022, which caused NTFS to refresh the $FILE_NAME timestamps while leaving $STANDARD_INFORMATION untouched by design.

Question 17

An analyst is reviewing an NTFS volume with the Sleuth Kit and notices that a file's $STANDARD_INFORMATION modified timestamp is 2023-04-01 09:12:00, while its $FILE_NAME modified timestamp is 2023-03-15 14:22:00. The analyst must determine which timestamp is more reliable for the actual file content modification. Which timestamp should be trusted, and why?

Accepted Answer

The $STANDARD_INFORMATION modified timestamp, because it is the primary timestamp updated by the operating system during normal file writes.. The $STANDARD_INFORMATION modified timestamp is updated by the file system when file content changes, making it the primary artifact for content modification. The $FILE_NAME timestamp is updated on name or path changes, not content writes. The later time in $STANDARD_INFORMATION indicates a content write occurred after the last name change, so it is the more reliable indicator here.

Answer

The $FILE_NAME modified timestamp, because it is stored in the directory index and therefore cannot be modified by user-level processes.

Answer

The $FILE_NAME modified timestamp, because it is updated only when the file's name or parent directory changes, making it resistant to user tampering.

Answer

Neither timestamp is reliable; the analyst must use the $MFT entry's sequence number to determine the last modification time.

Question 18

An analyst is reviewing an NTFS volume using TSK tools and runs `istat $MFT` on a file entry. The output shows that the $FILE_NAME attribute contains a Created timestamp of 2024-03-10 09:14:22, while the $STANDARD_INFORMATION attribute contains a Created timestamp of 2024-03-10 09:15:47. The file is a user document, and no timestomping tools were detected. What is the most likely reason for the 85-second discrepancy?

Accepted Answer

The $FILE_NAME Created timestamp reflects when the file record was first allocated, while $STANDARD_INFORMATION Created is updated by the operating system after the file is fully initialized.. NTFS stores timestamps in both the $FILE_NAME and $STANDARD_INFORMATION attributes, and they are not always written at the same instant. The $FILE_NAME Created value is set when the MFT record is allocated, while $STANDARD_INFORMATION Created can be finalized slightly later during initialization. A small gap like 85 seconds is normal and does not by itself indicate timestomping or corruption.

Answer

The $STANDARD_INFORMATION Created timestamp was modified by the Windows Search Indexer, which rewrites timestamps for indexed documents.

Answer

The $STANDARD_INFORMATION timestamp was updated when the file was copied into the volume, while $FILE_NAME preserved the original creation time.

Answer

The file system is corrupted and the $MFT entry has been partially overwritten, causing inconsistent timestamps between attributes.

Question 19

During a forensic examination of a Windows 10 NTFS volume, an analyst runs `fls -m C: -o 2048 -r /dev/sda1 > body.txt` and `mactime -b body.txt -d -z UTC > timeline.csv`. The analyst observes that a suspicious executable, `update.exe`, has an $STANDARD_INFORMATION (SI) modified timestamp of 2024-03-10 14:22:00 and a $FILE_NAME (FN) modified timestamp of 2024-03-10 14:25:30. Both timestamps are in UTC. What is the most likely explanation for the 3.5-minute discrepancy between the SI and FN timestamps?

Accepted Answer

The file's content was modified, updating the SI modified timestamp, and then the filename was changed 3.5 minutes later, updating the FN modified timestamp.. The discrepancy between SI and FN modified timestamps is a classic NTFS artifact. The SI modified timestamp reflects changes to file content or attributes, while the FN modified timestamp reflects changes to the filename or its metadata. A 3.5-minute gap suggests the file was modified first, then renamed later. This pattern is often seen in malware staging or user activity and is crucial for timeline reconstruction.

Answer

The system clock was adjusted backward by 3.5 minutes between the two timestamp updates.

Answer

The file was accessed 3.5 minutes after modification, updating the FN modified timestamp due to access time updates.

Answer

The file was copied from another volume, causing the FN timestamp to update while the SI timestamp remained unchanged.

Question 20

An investigator is building a file system timeline from an NTFS volume and wants to corroborate when a specific document was last accessed by a user. The volume has USN journal enabled and the system has been running continuously for weeks. Which TWO of the following artifacts would BEST support establishing the last access event in the timeline? (Choose two.)

Accepted Answer

Windows Search index database entries showing the document's content was indexed after a user opened it. Last access on NTFS is primarily reflected by the $STANDARD_INFORMATION last access timestamp, which NTFS updates on reads subject to configuration and throttling. Corroborating artifacts such as index or application-level records that reflect content processing can strengthen the conclusion. USN journal and $FILE_NAME timestamps track naming and write-related events, not reads, and $Bitmap tracks allocation, so they do not establish access.

Answer

The $FILE_NAME attribute timestamps within the same MFT record

Answer

USN journal entries referencing the file's record number with a DATA_EXTEND or CLOSE reason

Answer

The volume's $Bitmap allocation changes for clusters belonging to the document