GCFA File System Timeline Artifact Analysis Practice Test 2 — 15 Questions

Question 1

A forensic analyst is reviewing an NTFS $MFT extracted from a compromised server. For one suspicious executable, the $STANDARD_INFORMATION timestamps show creation and modification in 2019, but the $FILE_NAME timestamps show creation and modification in 2022. The system clock was verified as accurate throughout. Which conclusion is BEST supported by this discrepancy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was likely copied or restored onto the volume in 2022, causing NTFS to set new $FILE_NAME timestamps while the $STANDARD_INFORMATION timestamps were preserved from the original source.. When $STANDARD_INFORMATION timestamps predate $FILE_NAME timestamps by years on an accurately clocked system, the pattern commonly indicates a copy, restore, or timestomping operation where older metadata was preserved or set while NTFS wrote fresh $FILE_NAME values on this volume. Analysts should correlate with other artifacts before concluding, but the 2022 $FILE_NAME dates are more consistent with when the entry was placed here.

Answer

The file's $STANDARD_INFORMATION timestamps are unreliable because they are stored in the index, while $FILE_NAME timestamps are authoritative for the file itself.

Answer

The discrepancy is normal because NTFS updates $FILE_NAME timestamps only during volume mount operations, so the later dates reflect the last mount.

Answer

The file was compressed in 2022, which caused NTFS to refresh the $FILE_NAME timestamps while leaving $STANDARD_INFORMATION untouched by design.

Question 2

An analyst is reviewing an NTFS volume with the Sleuth Kit and notices that a file's $STANDARD_INFORMATION modified timestamp is 2023-04-01 09:12:00, while its $FILE_NAME modified timestamp is 2023-03-15 14:22:00. The analyst must determine which timestamp is more reliable for the actual file content modification. Which timestamp should be trusted, and why?

Accepted Answer

The $STANDARD_INFORMATION modified timestamp, because it is the primary timestamp updated by the operating system during normal file writes.. The $STANDARD_INFORMATION modified timestamp is updated by the file system when file content changes, making it the primary artifact for content modification. The $FILE_NAME timestamp is updated on name or path changes, not content writes. The later time in $STANDARD_INFORMATION indicates a content write occurred after the last name change, so it is the more reliable indicator here.

Answer

The $FILE_NAME modified timestamp, because it is stored in the directory index and therefore cannot be modified by user-level processes.

Answer

The $FILE_NAME modified timestamp, because it is updated only when the file's name or parent directory changes, making it resistant to user tampering.

Answer

Neither timestamp is reliable; the analyst must use the $MFT entry's sequence number to determine the last modification time.

Question 3

An analyst is reviewing an NTFS volume using TSK tools and runs `istat $MFT` on a file entry. The output shows that the $FILE_NAME attribute contains a Created timestamp of 2024-03-10 09:14:22, while the $STANDARD_INFORMATION attribute contains a Created timestamp of 2024-03-10 09:15:47. The file is a user document, and no timestomping tools were detected. What is the most likely reason for the 85-second discrepancy?

Accepted Answer

The $FILE_NAME Created timestamp reflects when the file record was first allocated, while $STANDARD_INFORMATION Created is updated by the operating system after the file is fully initialized.. NTFS stores timestamps in both the $FILE_NAME and $STANDARD_INFORMATION attributes, and they are not always written at the same instant. The $FILE_NAME Created value is set when the MFT record is allocated, while $STANDARD_INFORMATION Created can be finalized slightly later during initialization. A small gap like 85 seconds is normal and does not by itself indicate timestomping or corruption.

Answer

The $STANDARD_INFORMATION Created timestamp was modified by the Windows Search Indexer, which rewrites timestamps for indexed documents.

Answer

The $STANDARD_INFORMATION timestamp was updated when the file was copied into the volume, while $FILE_NAME preserved the original creation time.

Answer

The file system is corrupted and the $MFT entry has been partially overwritten, causing inconsistent timestamps between attributes.

Question 4

During a forensic examination of a Windows 10 NTFS volume, an analyst runs `fls -m C: -o 2048 -r /dev/sda1 > body.txt` and `mactime -b body.txt -d -z UTC > timeline.csv`. The analyst observes that a suspicious executable, `update.exe`, has an $STANDARD_INFORMATION (SI) modified timestamp of 2024-03-10 14:22:00 and a $FILE_NAME (FN) modified timestamp of 2024-03-10 14:25:30. Both timestamps are in UTC. What is the most likely explanation for the 3.5-minute discrepancy between the SI and FN timestamps?

Accepted Answer

The file's content was modified, updating the SI modified timestamp, and then the filename was changed 3.5 minutes later, updating the FN modified timestamp.. The discrepancy between SI and FN modified timestamps is a classic NTFS artifact. The SI modified timestamp reflects changes to file content or attributes, while the FN modified timestamp reflects changes to the filename or its metadata. A 3.5-minute gap suggests the file was modified first, then renamed later. This pattern is often seen in malware staging or user activity and is crucial for timeline reconstruction.

Answer

The system clock was adjusted backward by 3.5 minutes between the two timestamp updates.

Answer

The file was accessed 3.5 minutes after modification, updating the FN modified timestamp due to access time updates.

Answer

The file was copied from another volume, causing the FN timestamp to update while the SI timestamp remained unchanged.

Question 5

An investigator is building a file system timeline from an NTFS volume and wants to corroborate when a specific document was last accessed by a user. The volume has USN journal enabled and the system has been running continuously for weeks. Which TWO of the following artifacts would BEST support establishing the last access event in the timeline? (Choose two.)

Accepted Answer

Windows Search index database entries showing the document's content was indexed after a user opened it. Last access on NTFS is primarily reflected by the $STANDARD_INFORMATION last access timestamp, which NTFS updates on reads subject to configuration and throttling. Corroborating artifacts such as index or application-level records that reflect content processing can strengthen the conclusion. USN journal and $FILE_NAME timestamps track naming and write-related events, not reads, and $Bitmap tracks allocation, so they do not establish access.

Answer

The $FILE_NAME attribute timestamps within the same MFT record

Answer

USN journal entries referencing the file's record number with a DATA_EXTEND or CLOSE reason

Answer

The volume's $Bitmap allocation changes for clusters belonging to the document

Question 6

A forensic analyst is examining an NTFS volume using a write-blocker. While reviewing the $MFT, the analyst observes that a file's $FILE_NAME attribute shows a creation timestamp of 2023-08-10 14:22:01, but the $STANDARD_INFORMATION attribute shows a creation timestamp of 2023-08-10 14:22:05. Both timestamps are in UTC. What is the most likely explanation for this 4-second discrepancy?

Accepted Answer

The $FILE_NAME attribute timestamps are updated before the $STANDARD_INFORMATION timestamps during file creation, resulting in a slight lag.. The $FILE_NAME attribute timestamps are set when the file is created, and the $STANDARD_INFORMATION attribute timestamps are updated shortly afterward. This ordering can cause a small lag, typically a few seconds, where the $FILE_NAME creation time is earlier than the $STANDARD_INFORMATION creation time. This is a normal NTFS behavior and not indicative of anti-forensic activity.

Answer

The file was accessed by a program that modified the $STANDARD_INFORMATION timestamps but left the $FILE_NAME timestamps untouched.

Answer

The system clock was adjusted between the writing of the $FILE_NAME and $STANDARD_INFORMATION attributes.

Answer

The file was copied from another NTFS volume, and the $FILE_NAME timestamp reflects the original creation time.

Question 7

An investigator is examining an NTFS volume and finds that a file's $STANDARD_INFORMATION created timestamp is 2024-01-10 08:00:00, but its $FILE_NAME created timestamp is 2024-01-10 07:55:00. The file's USN journal shows a create event at 08:00:05. Which of the following best explains the 5-minute discrepancy between the two created timestamps?

Accepted Answer

The $FILE_NAME timestamp is set when the file is first created in the parent directory index, while the $STANDARD_INFORMATION timestamp is set slightly later when the MFT record is fully initialized.. The $FILE_NAME timestamp is set when the directory entry is created, and the $STANDARD_INFORMATION timestamp is set when the MFT record is initialized, which can occur a few moments later. The USN journal create event at 08:00:05 corroborates the $STANDARD_INFORMATION time as the later event. This is normal NTFS behavior and not indicative of tampering.

Answer

The $FILE_NAME timestamp is updated when the file is moved or renamed, so the earlier time indicates the file was renamed after creation.

Answer

The system clock was adjusted backward by 5 minutes between the two timestamp events, causing the discrepancy.

Answer

The $STANDARD_INFORMATION timestamp was modified by a user-level process after creation, while the $FILE_NAME timestamp remained unchanged.

Question 8

An investigator is analyzing a Windows 10 system and needs to determine when a specific USB drive was last connected. The investigator has access to the SYSTEM hive and the user's NTUSER.DAT hive. Which artifact directly records the volume serial number and last connection time for USB mass storage devices?

Accepted Answer

USBSTOR entries under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. USB mass storage device connection history is primarily recorded in the USBSTOR key under the SYSTEM hive. Each device subkey contains the volume serial number and a LastWrite timestamp that indicates when the device was last connected or its driver was installed. Other keys like MountPoints2 and Enum\USB provide supporting context but do not directly store the volume serial number and connection time together.

Answer

Portable Devices entries under HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices

Answer

USB device entries under HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

MountPoints2 entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 9

While building a supertimeline from a Windows 10 host using plaso, an analyst notices that several .lnk files in a user's Recent folder show a target file path that no longer exists on disk. The analyst wants to determine when the shortcut was last used to launch the missing application. Which log2timeline/plaso artifact parser output should the analyst correlate to establish the last launch time of the shortcut?

Accepted Answer

The Windows Shell Link (LNK) parser fields for target last access and the TrackerDataBlock distributed link tracking timestamps. Shortcut execution evidence is embedded inside the .lnk file itself, primarily through the TrackerDataBlock and target access timestamps written by the Shell when the target is accessed. Parsers that expose these fields let an analyst correlate shortcut usage to application launches even if the target has been deleted. File system metadata and journal records for the .lnk file only describe changes to the shortcut container, not the act of launching the target.

Answer

The $MFT $STANDARD_INFORMATION last modification timestamp of the .lnk file itself

Answer

The USN change journal $J record referencing the .lnk file's file reference number

Answer

The NTFS $LogFile redo/undo records for the volume where the .lnk resides

Question 10

An analyst is examining an NTFS volume and finds that a file's $STANDARD_INFORMATION creation timestamp is 2023-09-01 10:00:00, while its $FILE_NAME creation timestamp is 2023-09-01 10:00:00. However, the $STANDARD_INFORMATION modification timestamp is 2023-09-01 10:00:00, and the $FILE_NAME modification timestamp is 2023-09-01 10:00:00. The $MFT record header last modification time is 2023-09-01 10:05:00. Which TWO of the following actions could explain the $MFT record header modification time being later than the file's timestamps? (Choose two.)

Accepted Answer

An alternate data stream was added to the file, requiring an update to the MFT record.. The MFT record header timestamp is updated when the MFT record is modified, which can occur without changing the file's $STANDARD_INFORMATION or $FILE_NAME timestamps. Adding an alternate data stream creates a new attribute, requiring an MFT record update. Changing file attributes (e.g., toggling read-only) modifies the $STANDARD_INFORMATION attribute, which also updates the MFT record header. Both actions can leave the file's creation and modification timestamps unchanged, matching the observed data.

Answer

The file was renamed, updating the $FILE_NAME attribute and the MFT record header.

Answer

The file's content was modified, updating the $STANDARD_INFORMATION modification timestamp.

Answer

The file was moved to a different directory on the same volume, updating the $FILE_NAME attribute and the MFT record header.

Question 11

An analyst is examining an NTFS volume from a Windows 10 workstation using TSK tools. They run `istat` on an MFT record and observe that the $FILE_NAME attribute contains a namespace value of 2 (Win32 & DOS) while the $STANDARD_INFORMATION attribute's creation timestamp is several minutes later than the $FILE_NAME creation timestamp. What is the most likely explanation for this discrepancy?

Accepted Answer

The file was created on the NTFS volume, but the system clock was adjusted backward between the creation of the $FILE_NAME attribute and the $STANDARD_INFORMATION attribute, resulting in the $STANDARD_INFORMATION creation timestamp appearing later.. In NTFS, the $FILE_NAME attribute's timestamps are set when the file is created or renamed, while the $STANDARD_INFORMATION attribute's timestamps are updated by various system and user actions. A later $STANDARD_INFORMATION creation timestamp compared to $FILE_NAME creation timestamp is not typical; it often indicates that the system clock was adjusted backward after the $FILE_NAME timestamp was set, or that the file was created, then the clock was changed, and then the $STANDARD_INFORMATION timestamp was updated. This can be a sign of timestamp manipulation.

Answer

The file was created on a different file system and later copied to this NTFS volume, causing the $STANDARD_INFORMATION timestamps to be updated while preserving the original $FILE_NAME timestamps.

Answer

The file was created directly on the NTFS volume, and the $STANDARD_INFORMATION timestamps were later modified by a user-mode process using a Windows API that updates the $STANDARD_INFORMATION attribute without altering the $FILE_NAME attribute.

Answer

The file was created by a process that first created a temporary file with a different name, then renamed it, causing the $FILE_NAME timestamps to reflect the earlier creation and the $STANDARD_INFORMATION timestamps to be updated later.

Question 12

An analyst is examining an NTFS volume using `fsstat` and notices that the $MFT record for a critical file has a sequence number of 3, while the $MFT record number is 12345. The file's $STANDARD_INFORMATION creation timestamp is 2024-01-15 09:00:00, but the $FILE_NAME creation timestamp is 2024-01-20 11:30:00. The $LogFile indicates recent file system activity. What is the most likely explanation for the sequence number and timestamp discrepancy?

Accepted Answer

The file was created on 2024-01-15, deleted, and a new file with the same name was created on 2024-01-20, reusing the same MFT record.. The sequence number of 3 indicates that the MFT record has been reused multiple times. When a file is deleted, its MFT record is freed, and the sequence number is incremented. If a new file reuses that record, it inherits the incremented sequence number. The later FN creation timestamp likely reflects the new file's creation, while the SI creation timestamp may be from the previous file or manipulated. This pattern is critical for detecting file system tunneling or anti-forensic activity.

Answer

The file was copied from another NTFS volume on 2024-01-20, preserving the $STANDARD_INFORMATION creation timestamp but creating a new $FILE_NAME creation timestamp.

Answer

The file's $STANDARD_INFORMATION creation timestamp was altered by a timestomping tool, while the $FILE_NAME creation timestamp remained original.

Answer

The file was created on 2024-01-15 and then moved to a different directory on 2024-01-20, updating the $FILE_NAME creation timestamp.

Question 13

A forensic analyst is examining an NTFS volume and finds that a file's $STANDARD_INFORMATION access timestamp is 2024-02-01 10:00:00, but the file's $LogFile shows no record of a read operation after 2024-01-15. The system's last shutdown time was 2024-01-20. Which of the following is the most likely explanation for the access timestamp?

Accepted Answer

The access timestamp was likely modified by an anti-forensic tool or through direct MFT manipulation, as it postdates the last shutdown and lacks corroborating $LogFile activity.. The access timestamp postdates the last shutdown, indicating the system was not active to perform a read. The $LogFile, which records file system transactions, shows no read activity after 2024-01-15. This combination suggests the timestamp was manipulated, likely by an anti-forensic tool or direct MFT modification, rather than resulting from normal file access.

Answer

The access timestamp was updated by a background process or antivirus scan that does not generate a $LogFile entry.

Answer

The access timestamp was updated by a user-level process that modified the file's metadata, which can update the access timestamp without a corresponding $LogFile read entry.

Answer

The access timestamp was updated because the file was opened and read, but the $LogFile had already been overwritten due to its circular buffer nature.

Question 14

An analyst is building a timeline from an NTFS volume and wants to identify evidence of timestomping. Which TWO of the following observations are reliable indicators of timestomping in the $STANDARD_INFORMATION attribute? (Choose two.)

Accepted Answer

$STANDARD_INFORMATION Created timestamp is earlier than the $FILE_NAME Created timestamp for the same file.. Timestomping often leaves two reliable traces: $STANDARD_INFORMATION timestamps with zero sub-second precision when other files have nonzero values, and $STANDARD_INFORMATION Created being earlier than $FILE_NAME Created. Both patterns arise because tools typically set whole-second timestamps and may not update the $FILE_NAME attribute consistently. Link count, sequence number, and future timestamps are not reliable standalone indicators.

Answer

The file's $STANDARD_INFORMATION Modified timestamp is later than the current system time.

Answer

The $MFT record sequence number is greater than one, showing the record was reused after deletion.

Answer

The file has a link count greater than one, indicating multiple hard links were created to obscure the original timestamps.

Question 15

A forensic analyst is examining an NTFS file system timeline and wants to identify files that may have been timestomped. Which TWO of the following indicators are most reliable for detecting timestomping? (Choose two.)

Accepted Answer

The $STANDARD_INFORMATION timestamps are set to a date that is earlier than the volume's creation date.. Timestomping often leaves timestamps that are inconsistent with the file system's timeline. Setting $STANDARD_INFORMATION timestamps to a date before the volume creation date is impossible under normal operation and strongly suggests manipulation. Similarly, zeroed or future-dated timestamps are not produced by normal file operations and are reliable indicators of timestomping.

Answer

The $STANDARD_INFORMATION timestamps have sub-second precision that does not match the $FILE_NAME timestamps.

Answer

The $STANDARD_INFORMATION timestamps are earlier than the $FILE_NAME timestamps.

Answer

The $FILE_NAME timestamps are all identical to each other and to the $STANDARD_INFORMATION timestamps.