GCFA File System Timeline Artifact Analysis — All Questions With Answers

Question 1mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is investigating an NTFS volume and notices that a file's $STANDARD_INFORMATION attribute modified timestamp is significantly earlier than its $FILE_NAME attribute modified timestamp. What is the most likely cause of this discrepancy during a forensic examination?

Question 2mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is investigating a suspected malware execution. They notice the MFT entry for 'svchost.exe' shows a file creation time that is earlier than the MFT record modification time. Which artifact-based technique should the analyst employ to determine if a timestomp occurred?

Question 3hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

Which TWO of the following artifacts provide the most reliable evidence for reconstructing file system access history during a timeline analysis?

Question 4mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

Refer to the exhibit. Based on the provided MFT attributes, what is the most likely conclusion regarding this file?

Exhibit

MFT Entry: 12345
SI Created: 2023-01-01 10:00:00
SI Modified: 2023-01-01 10:05:00
FN Created: 2023-01-05 12:00:00
FN Modified: 2023-01-05 12:05:00

Question 5easymultiple choice

Read the full File System Timeline Artifact Analysis explanation →

When conducting a timeline analysis, which artifact is considered the most reliable source for determining when a file was actually deleted from an NTFS volume?

Question 6mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst discovers a file with a 'Last Accessed' time that is significantly earlier than its 'Creation' time. What is the most appropriate forensic interpretation of this observation?

Question 7mediummulti select

Read the full File System Timeline Artifact Analysis explanation →

Which THREE of the following artifacts are commonly utilized to corroborate file system activity in a timeline analysis?

Question 8hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

During a deep dive into an NTFS volume, you encounter a file where the $SI creation time is later than the $SI modification time. What does this indicate?

Question 9mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

Which artifact is most useful for identifying the 'User' account associated with the creation of a specific file on a Windows system?

Question 10mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

When analyzing the $MFT, what is the significance of an entry having a sequence number of 1?

Question 11mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

Which of the following describes the purpose of the 'Standard Information' (SI) attribute in an NTFS MFT record?

Question 12hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

During an NTFS file system timeline analysis using Sleuth Kit tools, an analyst observes multiple entries where the $MFT record's link count dropped to zero, yet data runs remain allocated. Which TWO file system phenomena or actions could produce this specific timeline artifact pattern?

Question 13mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

When constructing a filesystem timeline on a Linux EXT4 system, which artifact is the most reliable indicator of file metadata modification (mtime) versus status change time (ctime)?

Question 14hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

Which TWO of the following actions typically result in a modification of the $Standard_Information attribute in an NTFS filesystem?

Question 15mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

Based on the MFT exhibit, what conclusion can the forensic analyst draw about the file?

Exhibit

Refer to the exhibit.
[MFT Entry 1234]
$STANDARD_INFORMATION: Mod: 2023-05-01 10:00:00.000, Acc: 2023-05-01 10:00:00.000, Chg: 2023-05-01 10:00:00.000, Birth: 2023-05-01 10:00:00.000
$FILE_NAME: Mod: 2023-05-01 12:00:00.000, Acc: 2023-05-01 12:00:00.000, Chg: 2023-05-01 12:00:00.000, Birth: 2023-05-01 12:00:00.000

Question 16hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is reviewing an NTFS $MFT extracted from a compromised server. For one suspicious executable, the $STANDARD_INFORMATION timestamps show creation and modification in 2019, but the $FILE_NAME timestamps show creation and modification in 2022. The system clock was verified as accurate throughout. Which conclusion is BEST supported by this discrepancy?

Question 17mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is reviewing an NTFS volume with the Sleuth Kit and notices that a file's $STANDARD_INFORMATION modified timestamp is 2023-04-01 09:12:00, while its $FILE_NAME modified timestamp is 2023-03-15 14:22:00. The analyst must determine which timestamp is more reliable for the actual file content modification. Which timestamp should be trusted, and why?

Question 18mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is reviewing an NTFS volume using TSK tools and runs `istat $MFT` on a file entry. The output shows that the $FILE_NAME attribute contains a Created timestamp of 2024-03-10 09:14:22, while the $STANDARD_INFORMATION attribute contains a Created timestamp of 2024-03-10 09:15:47. The file is a user document, and no timestomping tools were detected. What is the most likely reason for the 85-second discrepancy?

Question 19mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

During a forensic examination of a Windows 10 NTFS volume, an analyst runs `fls -m C: -o 2048 -r /dev/sda1 > body.txt` and `mactime -b body.txt -d -z UTC > timeline.csv`. The analyst observes that a suspicious executable, `update.exe`, has an $STANDARD_INFORMATION (SI) modified timestamp of 2024-03-10 14:22:00 and a $FILE_NAME (FN) modified timestamp of 2024-03-10 14:25:30. Both timestamps are in UTC. What is the most likely explanation for the 3.5-minute discrepancy between the SI and FN timestamps?

Question 20mediummulti select

Read the full File System Timeline Artifact Analysis explanation →

An investigator is building a file system timeline from an NTFS volume and wants to corroborate when a specific document was last accessed by a user. The volume has USN journal enabled and the system has been running continuously for weeks. Which TWO of the following artifacts would BEST support establishing the last access event in the timeline? (Choose two.)

Question 21mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining an NTFS volume using a write-blocker. While reviewing the $MFT, the analyst observes that a file's $FILE_NAME attribute shows a creation timestamp of 2023-08-10 14:22:01, but the $STANDARD_INFORMATION attribute shows a creation timestamp of 2023-08-10 14:22:05. Both timestamps are in UTC. What is the most likely explanation for this 4-second discrepancy?

Question 22hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An investigator is examining an NTFS volume and finds that a file's $STANDARD_INFORMATION created timestamp is 2024-01-10 08:00:00, but its $FILE_NAME created timestamp is 2024-01-10 07:55:00. The file's USN journal shows a create event at 08:00:05. Which of the following best explains the 5-minute discrepancy between the two created timestamps?

Question 23mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An investigator is analyzing a Windows 10 system and needs to determine when a specific USB drive was last connected. The investigator has access to the SYSTEM hive and the user's NTUSER.DAT hive. Which artifact directly records the volume serial number and last connection time for USB mass storage devices?

Question 24mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

While building a supertimeline from a Windows 10 host using plaso, an analyst notices that several .lnk files in a user's Recent folder show a target file path that no longer exists on disk. The analyst wants to determine when the shortcut was last used to launch the missing application. Which log2timeline/plaso artifact parser output should the analyst correlate to establish the last launch time of the shortcut?

Question 25hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

An analyst is examining an NTFS volume and finds that a file's $STANDARD_INFORMATION creation timestamp is 2023-09-01 10:00:00, while its $FILE_NAME creation timestamp is 2023-09-01 10:00:00. However, the $STANDARD_INFORMATION modification timestamp is 2023-09-01 10:00:00, and the $FILE_NAME modification timestamp is 2023-09-01 10:00:00. The $MFT record header last modification time is 2023-09-01 10:05:00. Which TWO of the following actions could explain the $MFT record header modification time being later than the file's timestamps? (Choose two.)

Question 26mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is examining an NTFS volume from a Windows 10 workstation using TSK tools. They run `istat` on an MFT record and observe that the $FILE_NAME attribute contains a namespace value of 2 (Win32 & DOS) while the $STANDARD_INFORMATION attribute's creation timestamp is several minutes later than the $FILE_NAME creation timestamp. What is the most likely explanation for this discrepancy?

Question 27hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is examining an NTFS volume using `fsstat` and notices that the $MFT record for a critical file has a sequence number of 3, while the $MFT record number is 12345. The file's $STANDARD_INFORMATION creation timestamp is 2024-01-15 09:00:00, but the $FILE_NAME creation timestamp is 2024-01-20 11:30:00. The $LogFile indicates recent file system activity. What is the most likely explanation for the sequence number and timestamp discrepancy?

Question 28mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining an NTFS volume and finds that a file's $STANDARD_INFORMATION access timestamp is 2024-02-01 10:00:00, but the file's $LogFile shows no record of a read operation after 2024-01-15. The system's last shutdown time was 2024-01-20. Which of the following is the most likely explanation for the access timestamp?

Question 29hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

An analyst is building a timeline from an NTFS volume and wants to identify evidence of timestomping. Which TWO of the following observations are reliable indicators of timestomping in the $STANDARD_INFORMATION attribute? (Choose two.)

Question 30hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining an NTFS file system timeline and wants to identify files that may have been timestomped. Which TWO of the following indicators are most reliable for detecting timestomping? (Choose two.)

Question 31easymultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining an NTFS file system and finds a file with the following timestamps: $STANDARD_INFORMATION creation: 2023-07-15 08:30:00, $STANDARD_INFORMATION modification: 2023-07-15 08:30:00, $FILE_NAME creation: 2023-07-15 08:30:00, $FILE_NAME modification: 2023-07-15 08:30:00. The file's $MFT record header last modification time is 2023-07-15 08:30:00. The file is located in a directory that was created on 2023-07-14 09:00:00. Based on this information, what is the most likely conclusion about the file?

Question 32hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is analyzing an ext4 file system image using The Sleuth Kit. They run `fls -r -m /` to generate a body file and then `mactime` to create a timeline. They notice that several files have a 'c' timestamp (inode change time) that is much later than the 'm' (modification) and 'a' (access) timestamps, and these files are located in a directory that was recently deleted. What is the most likely cause of the later 'c' timestamp?

Question 33mediummulti select

Read the full File System Timeline Artifact Analysis explanation →

An examiner is preparing to build a supertimeline from an NTFS volume using log2timeline/plaso and wants to ensure that file system-level events are captured with accurate timestamps. Which TWO of the following steps are necessary to correctly capture NTFS file system timeline events in the resulting plaso storage file? (Choose two.)

Question 34easymultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining an ext4 file system image using The Sleuth Kit. They run `fls -r -m / -o 2048 /dev/sda1` and generate a body file, then use `mactime` to create a timeline. The analyst notices that several deleted files have inode numbers but no corresponding entries in the directory listing. Which ext4 feature is most directly responsible for the persistence of these deleted file inodes in the timeline?

Question 35hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

An analyst is examining an ext4 file system image and notices that a file's inode change time (ctime) is significantly later than its modification time (mtime). Which TWO of the following actions could explain this discrepancy? (Choose two.)

Question 36mediummulti select

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is analyzing a Windows 10 system and wants to identify file system timeline artifacts that can reliably indicate when a file was last accessed. Which TWO of the following artifacts should the analyst examine? (Choose two.)

Question 37mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is analyzing a Windows 10 system and wants to determine when a specific file was last accessed. The file is located on an NTFS volume. The analyst checks the $STANDARD_INFORMATION attribute and sees an access timestamp of 2024-02-01 08:00:00. However, the $FILE_NAME attribute shows an access timestamp of 2024-01-15 12:00:00. The system has the default Windows 10 configuration for last access time updates. Which timestamp is more reliable for determining the last access time, and why?

Question 38mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is using The Sleuth Kit (TSK) to create a timeline from an NTFS image. They run 'fls -r -m C: image.dd > bodyfile.txt' and then 'mactime -b bodyfile.txt -d'. They notice that for a particular file, the timeline shows an entry for 'mac' times (modified, accessed, changed) but no 'b' (born) time. What is the most likely reason for the absence of the born time in the timeline?

Question 39mediummulti select

Read the full File System Timeline Artifact Analysis explanation →

An analyst is building a file system timeline from an NTFS volume using The Sleuth Kit. They want to identify files that may have been timestomped. Which TWO of the following artifacts or techniques should they prioritize to detect potential timestamp manipulation? (Choose two.)

Question 40hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

During a forensic examination of an NTFS volume, an analyst discovers a file with the following timestamps: $STANDARD_INFORMATION creation: 2023-06-10 09:00:00, $STANDARD_INFORMATION modification: 2023-06-10 09:00:00, $FILE_NAME creation: 2023-06-10 09:00:00, $FILE_NAME modification: 2023-06-10 09:00:00. However, the $STANDARD_INFORMATION MFT change timestamp is 2023-06-11 10:00:00, and the $FILE_NAME MFT change timestamp is 2023-06-11 10:00:00. The MFT record header last modification time is 2023-06-11 10:00:00. Which of the following is the most likely explanation for the MFT change timestamps being later than the creation and modification timestamps?

Question 41hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is examining an NTFS volume and finds a file with the following $STANDARD_INFORMATION timestamps: Created: 2024-02-01 08:00:00, Modified: 2024-02-01 08:00:00, MFT Modified: 2024-02-01 08:00:00, Accessed: 2024-02-01 08:00:00. The $FILE_NAME timestamps are: Created: 2024-02-01 08:00:00, Modified: 2024-02-01 08:00:00. The file's $MFT record sequence number is 1. The $LogFile shows no entries for this file. What is the most likely conclusion about this file?

Question 42hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining an NTFS volume and observes that a particular file's $STANDARD_INFORMATION MFT Change timestamp is significantly later than its $FILE_NAME MFT Change timestamp. The file is located in a user's Documents folder and is not a system file. What is the most likely explanation for this discrepancy?

Question 43hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

Refer to the exhibit. What can be inferred about the file activity?

Exhibit

USN Journal Entry:
Reason: Data_Extend | Timestamp: 2023-05-01 14:00:05
Reason: File_Create | Timestamp: 2023-05-01 14:00:01

Question 44hardmulti select

Read the full File System Timeline Artifact Analysis explanation →

Which TWO of the following actions are considered 'anti-forensic' techniques that directly impact file system timeline analysis?

Question 45mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is examining a file that was deleted. Why is the 'File Name' (FN) attribute in the MFT still potentially readable?

Question 46mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

Which of the following is true regarding the 'MFT Change' timestamp?

Question 47easymultiple choice

Read the full File System Timeline Artifact Analysis explanation →

What is the primary function of the $LogFile in an NTFS file system?

Question 48mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An investigator analyzing an NTFS volume notices that a file's $STANDARD_INFORMATION MACB timestamps significantly differ from its $FILE_NAME timestamps. The $FILE_NAME modification time predates the $STANDARD_INFORMATION modification time. What is the most reliable forensic interpretation of this discrepancy?

Question 49mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An investigator is analyzing ext4 file system timelines extracted via fls and mactime. They notice that an inode's ctime was updated recently, but the atime and mtime remained unchanged. What does this specific combination of inode timestamp changes typically indicate in a Linux environment?

Question 50hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An investigator is analyzing MACB timelines on a Windows system and needs to differentiate between a file being copied versus being moved within the same NTFS volume. Which timeline artifact behavior distinguishes an intra-volume file move from a file copy operation?

Question 51mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is examining an NTFS volume and notices a discrepancy where the $Standard_Information attribute modification time is earlier than the $File_Name attribute modification time. What does this specific pattern indicate about the file's history?

Question 52hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

When analyzing the $LogFile in NTFS, what is the significance of the undo and redo operations recorded in the transaction logs for timeline reconstruction?

Question 53mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An investigator is examining a Windows 10 workstation's NTFS volume with Sleuth Kit tools. They run fls against the volume and observe that a deleted file's MFT entry still shows a valid $FILE_NAME attribute referencing the parent directory, but the $DATA attribute's resident content is now zero-filled. Which interpretation of this artifact is MOST accurate for the timeline?

Question 54hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

During an investigation of an ext4 file system, an analyst runs `fls -r -m /` and `mactime` to build a body file. The analyst observes that many deleted files show a dtime in the body file, but the mactime timeline places those dtime entries at the time the file was deleted. A colleague claims that dtime in ext4 always represents the time the inode was last modified. Which statement correctly describes ext4 dtime behavior in this timeline context?

Question 55mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

During a Windows 10 intrusion investigation, an analyst uses fls on a raw NTFS image and observes that for a suspicious executable, the $FILE_NAME creation timestamp is 2023-08-10 14:22:01, while the $STANDARD_INFORMATION creation timestamp is 2023-08-10 14:22:01 as well, but the $STANDARD_INFORMATION modified timestamp is 2023-08-10 14:22:01 and the $FILE_NAME modified timestamp is 2023-08-10 14:22:01. However, the $MFT record header's last modification time (the MFT entry itself) is 2023-08-10 14:25:33. What is the most likely explanation for the discrepancy between the MFT record modification time and the file's timestamps?

Question 56hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is reviewing an NTFS file system timeline and notices that a file's $STANDARD_INFORMATION modified timestamp is 2024-01-15 10:00:00, while its $FILE_NAME modified timestamp is 2024-01-15 09:55:00. The file's $MFT record shows a USN journal entry indicating a rename operation at 09:54:00. There is no other metadata. Which of the following is the most likely explanation for the 5-minute difference between the two modified timestamps?

Question 57hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An examiner is reviewing an APFS volume from a macOS 13 system. Using a timeline tool that parses APFS metadata, the analyst observes a file whose inode has an added date (birth time) earlier than its modified time, and the file's data stream shows a sparse extent. The case requires establishing the earliest credible creation time for the file. Which APFS attribute should the analyst rely on as the file's creation time?

Question 58easymultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining a Windows 10 system and finds a prefetch file named `CMD.EXE-1234ABCD.pf`. The analyst wants to determine the last time the program was executed. Which timestamp in the prefetch file should the analyst use?

Question 59mediummultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is examining an ext4 file system image from a Linux server. Using fls and istat from The Sleuth Kit, the analyst sees a deleted file whose inode still contains block pointers that now point to blocks reallocated to another file. The analyst wants to determine whether the deleted file's content can be recovered intact. Which ext4 condition best explains why the content is likely unrecoverable?

Question 60easymultiple choice

Read the full File System Timeline Artifact Analysis explanation →

A forensic analyst is creating a timeline from an NTFS volume and wants to include the $MFT's record number 0, which contains metadata about the MFT itself. What is the primary purpose of including this record in the timeline?

Question 61hardmultiple choice

Read the full File System Timeline Artifact Analysis explanation →

During an investigation of a Windows system, an analyst is reviewing a supertimeline and observes that a suspicious executable's $STANDARD_INFORMATION timestamps are all set to a date years before the operating system was installed, while its $FILE_NAME timestamps reflect the actual installation period. The analyst suspects timestomping. Which conclusion is most defensible based on NTFS timestamp behavior?

Question 62easymultiple choice

Read the full File System Timeline Artifact Analysis explanation →

An analyst is using The Sleuth Kit to analyze an NTFS image. They run `fls -r -m C:/` to generate a body file and then `mactime -b bodyfile -d` to produce a timeline. They notice that the timeline includes entries for files with a '$' prefix, such as $MFT, $LogFile, and $Bitmap. What is the most appropriate action for the analyst to take regarding these entries?

Refer to the exhibit. [MFT Entry 1234] $STANDARD_INFORMATION: Mod: 2023-05-01 10:00:00.000, Acc: 2023-05-01 10:00:00.000, Chg: 2023-05-01 10:00:00.000, Birth: 2023-05-01 10:00:00.000 $FILE_NAME: Mod: 2023-05-01 12:00:00.000, Acc: 2023-05-01 12:00:00.000, Chg: 2023-05-01 12:00:00.000, Birth: 2023-05-01 12:00:00.000