GCFA File System Timeline Artifact Analysis Practice Test 1 — 15 Questions

Question 1

An analyst is investigating an NTFS volume and notices that a file's $STANDARD_INFORMATION attribute modified timestamp is significantly earlier than its $FILE_NAME attribute modified timestamp. What is the most likely cause of this discrepancy during a forensic examination?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was copied to a new location within the same volume, causing $FILE_NAME to update while $STANDARD_INFORMATION was preserved.. Timestamp discrepancies between $STANDARD_INFORMATION and $FILE_NAME frequently occur when a file is copied or moved within the same NTFS volume. The copy operation creates new metadata where the $FILE_NAME is updated to the current time, while the $STANDARD_INFORMATION may retain copied or modified values depending on the specific user-space tool utilized.

Answer

The file was modified by the operating system kernel during a routine defragmentation pass.

Answer

An automated antivirus scanner accessed the file and updated the access time without altering metadata.

Answer

The system clock was manually adjusted backward by an attacker attempting to conceal malicious activity.

Question 2

An analyst is investigating a suspected malware execution. They notice the MFT entry for 'svchost.exe' shows a file creation time that is earlier than the MFT record modification time. Which artifact-based technique should the analyst employ to determine if a timestomp occurred?

Accepted Answer

Compare Standard Information (SI) attributes with File Name (FN) attributes.. Comparing standard information (SI) attributes with file name (FN) attributes is critical in NTFS forensics. When a file is moved or copied, the FN attribute reflects the original creation time, whereas the SI attribute is easily manipulated by user-mode APIs. Discrepancies between these two timestamps are a hallmark indicator of timestomping. This matters because attackers frequently modify metadata to hide their activities within the file system hierarchy, requiring analysts to cross-reference multiple MFT attributes for integrity validation.

Answer

Analyze the USN Journal for log gaps.

Answer

Examine the INDX records for file deletion.

Answer

Calculate the file hash and query VirusTotal.

Question 3

Which TWO of the following artifacts provide the most reliable evidence for reconstructing file system access history during a timeline analysis?

Accepted Answer

Shell Items (LNK Files). The Shell Items (LNK files) and the USN Journal are essential because they capture specific events rather than just static metadata. LNK files track user interaction and file paths, while the USN Journal provides a chronological log of file system changes. Relying on these prevents reliance on malleable metadata that attackers often exploit. Accurate timeline reconstruction requires correlation between user activity and underlying file system changes to prove specific malicious actions occurred.

Answer

MFT File Creation Timestamp

Answer

Registry 'LastWrite' times

Answer

File metadata (SI 'Modified' time)

Question 4

Refer to the exhibit. Based on the provided MFT attributes, what is the most likely conclusion regarding this file?

Accepted Answer

The file was timestomped to appear older than it is.. The exhibit shows a scenario where the SI creation time is earlier than the FN creation time. In standard Windows file operations, the FN attribute should be identical to or older than the SI attribute because FN is created during the file's birth. If SI is older than FN, it implies that the SI attribute was likely manually modified by an attacker, effectively 'timestomping' the file to predate its actual existence on the disk.

Answer

The file was moved from an NTFS partition to FAT32.

Answer

The file system encountered a cluster allocation error.

Answer

The operating system auto-updated the file metadata.

Question 5

When conducting a timeline analysis, which artifact is considered the most reliable source for determining when a file was actually deleted from an NTFS volume?

Accepted Answer

The $UsnJrnl (Update Sequence Number Journal).. The $LogFile and the $UsnJrnl are the primary sources for deletion events. While the MFT entry itself might be marked as free, the journal records contain transaction history that explicitly logs the deletion operation. Identifying the exact moment of deletion is critical for establishing a temporal boundary for attacker activities and determining what files were present during a specific window of time.

Answer

The MFT record's 'Deleted' flag.

Answer

The Recycle Bin's INFO2/index file.

Answer

Windows Event Log ID 4660.

Question 6

An analyst discovers a file with a 'Last Accessed' time that is significantly earlier than its 'Creation' time. What is the most appropriate forensic interpretation of this observation?

Accepted Answer

The file is a result of MFT record reuse.. In NTFS, the 'Last Accessed' time is often updated by search indexers, antivirus scanners, or anti-forensic tools. If the access time is earlier than the creation time, it suggests the MFT record was either timestomped or the record was reused by the OS for a new file while retaining remnants of the previous file's metadata in the access field. This is a common phenomenon that analysts must recognize to avoid misinterpreting file age.

Answer

The system clock was synchronized incorrectly.

Answer

An attacker manually changed the creation time.

Answer

The file was copied from an external drive.

Question 7

Which THREE of the following artifacts are commonly utilized to corroborate file system activity in a timeline analysis?

Accepted Answer

Prefetch Files. Correlation is the cornerstone of effective timeline analysis. By combining MFT records, event logs, and prefetch files, an analyst can verify if a file was merely present on the disk or if it was actively executed by a user or process. This triangulation mitigates the risk of relying on single, potentially manipulated data points, ensuring a robust and defensible reconstruction of events that transpired on the host.

Answer

BIOS/UEFI Time Settings

Answer

Volume Shadow Copies

Question 8

During a deep dive into an NTFS volume, you encounter a file where the $SI creation time is later than the $SI modification time. What does this indicate?

Accepted Answer

The file was likely moved or renamed.. This condition is often referred to as a 'birth-after-death' anomaly. It occurs when a file is moved within the same partition or modified in a way that causes the kernel to update the modification time but not the creation time, or vice-versa. Understanding these logical quirks is essential for forensic analysts to avoid incorrectly flagging benign system behaviors as malicious tampering or timestomping, which is common in complex NTFS environments.

Answer

The file has been actively timestomped.

Answer

The file is corrupted or fragmented.

Answer

The system clock was reset during an update.

Question 9

Which artifact is most useful for identifying the 'User' account associated with the creation of a specific file on a Windows system?

Accepted Answer

Security Event Logs (4624/4672).. Identifying the actor is just as important as identifying the action. Windows does not store the 'owner' in the MFT metadata in a way that tracks the creator's identity directly. Instead, analysts must correlate file creation times with security event logs (specifically Logon/Logoff events) or shell artifacts. This allows the investigator to map the file creation timestamp to a specific authenticated user session, which is necessary for attributing malicious actions to a specific threat actor.

Answer

The MFT File Owner SID.

Answer

The $LogFile transaction history.

Answer

The file's 'Last Accessed' time.

Question 10

When analyzing the $MFT, what is the significance of an entry having a sequence number of 1?

Accepted Answer

The MFT record has been reused once.. The sequence number in an MFT entry is incremented whenever a file record is reused. A sequence number of 1 indicates the record has been used very few times, suggesting a recently created file or a system that has not experienced significant file creation/deletion churn. This helps in understanding the lifespan of the file and whether the record is likely to have been recycled, which is crucial for determining the reliability of the metadata.

Answer

The file is a system-reserved protected file.

Answer

The file has been flagged for deletion.

Answer

The file is stored in a hidden directory.

Question 11

Which of the following describes the purpose of the 'Standard Information' (SI) attribute in an NTFS MFT record?

Accepted Answer

To record the timestamps used by the OS shell.. The SI attribute is the primary location for file timestamps visible to users and operating system applications. Because it is exposed to user-mode APIs, it is the most common target for attackers performing timestomping. Forensic analysts must understand that while SI is convenient for quick analysis, it is not the authoritative source for file events, as the File Name (FN) attribute serves as a more robust, kernel-level verification point for temporal data.

Answer

To store the file's actual data contents.

Answer

To define the security access control list.

Answer

To manage the file's compression status.

Question 12

During an NTFS file system timeline analysis using Sleuth Kit tools, an analyst observes multiple entries where the $MFT record's link count dropped to zero, yet data runs remain allocated. Which TWO file system phenomena or actions could produce this specific timeline artifact pattern?

Accepted Answer

A process has an open handle to the file while an unlinking operation occurred, delaying full cluster deallocation until the handle is closed.. Understanding how NTFS handles file deletion and hard links is vital for uncovering hidden data. When link counts hit zero without immediate cluster deallocation, it usually points to open file handles preventing deletion completion or specialized forensic scenarios. Recognizing these artifacts prevents analysts from missing active evidence residing in unlinked yet un-freed MFT records.

Answer

The file system underwent a routine check via chkdsk, which orphaned the file record and moved its extents to the Found.000 directory structure.

Answer

The file was subjected to aggressive zero-fill wiping, which explicitly clears the link count field before overwriting the allocated data clusters.

Answer

The file system journal ($USNJRNL) recorded an unexpected volume dismount while transaction logging was actively processing an incremental backup.

Question 13

When constructing a filesystem timeline on a Linux EXT4 system, which artifact is the most reliable indicator of file metadata modification (mtime) versus status change time (ctime)?

Accepted Answer

The ctime (change time) field.. In EXT4, the ctime (change time) records the last time the inode was modified, including changes to permissions, ownership, or links, which cannot be easily backdated. The mtime (modification time) reflects content changes. Understanding this distinction is crucial because attackers can easily reset mtime using the 'touch' command, but they cannot manipulate ctime without kernel-level access or modifying the system clock during the event.

Answer

The atime (access time) field.

Answer

The dtime (deletion time) field.

Answer

The file birth time (crtime) field.

Question 14

Which TWO of the following actions typically result in a modification of the $Standard_Information attribute in an NTFS filesystem?

Accepted Answer

Writing new data to an existing file.. The $Standard_Information attribute contains the MACB (Modified, Accessed, Changed, Birth) timestamps visible to standard Windows APIs. Any action that alters the file's content or fundamental file system status will trigger an update to this attribute. Knowing which actions trigger these updates allows investigators to reconstruct user activity and identify evidence of file access or tampering during the timeline analysis phase.

Answer

Renaming a file within the same directory.

Answer

Reading a file using a preview pane.

Answer

Moving a file to a different folder on the same volume.

Question 15

Based on the MFT exhibit, what conclusion can the forensic analyst draw about the file?

Accepted Answer

The file has been subjected to anti-forensic timestomping.. The exhibit shows a clear timestamp discrepancy between the $Standard_Information and $File_Name attributes. In NTFS, the $File_Name attribute is updated by the system kernel, while $Standard_Information is easily reachable by user-space applications. When the $Standard_Information times are perfectly rounded to the second and are earlier than the $File_Name times, it is a high-confidence indicator of timestamp manipulation performed by a tool attempting to hide the file's activity.

Answer

The file system is corrupted and requires a chkdsk fix.

Answer

The file was created on a different operating system.

Answer

The file was moved from a FAT32 partition to NTFS.