GCFA File System Timeline Artifact Analysis Practice Test 3 — 15 Questions

Question 1

A forensic analyst is examining an NTFS file system and finds a file with the following timestamps: $STANDARD_INFORMATION creation: 2023-07-15 08:30:00, $STANDARD_INFORMATION modification: 2023-07-15 08:30:00, $FILE_NAME creation: 2023-07-15 08:30:00, $FILE_NAME modification: 2023-07-15 08:30:00. The file's $MFT record header last modification time is 2023-07-15 08:30:00. The file is located in a directory that was created on 2023-07-14 09:00:00. Based on this information, what is the most likely conclusion about the file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was created on 2023-07-15 08:30:00 and has not been modified since.. The identical timestamps across $STANDARD_INFORMATION, $FILE_NAME, and the MFT record header indicate that the file was created at 2023-07-15 08:30:00 and has not been modified, renamed, or had its attributes changed since. The directory creation date being earlier is consistent with normal file creation within an existing directory. Therefore, the most likely conclusion is that the file was created at that time and remained unchanged.

Answer

The file was copied into the directory on 2023-07-15 08:30:00 from another location.

Answer

The file was created on 2023-07-15 08:30:00 but was modified later without updating the timestamps.

Answer

The file's timestamps were manipulated to make it appear older than it is.

Question 2

A forensic analyst is analyzing an ext4 file system image using The Sleuth Kit. They run `fls -r -m /` to generate a body file and then `mactime` to create a timeline. They notice that several files have a 'c' timestamp (inode change time) that is much later than the 'm' (modification) and 'a' (access) timestamps, and these files are located in a directory that was recently deleted. What is the most likely cause of the later 'c' timestamp?

Accepted Answer

The directory containing the files was deleted, which caused the link count of the files to be decremented, updating their inode change time ('c') while leaving modification and access times intact.. In ext4, the inode change time ('c') is updated whenever file metadata changes, such as permissions, ownership, or link count. When a directory is deleted, the files within it are not directly affected unless they are moved or their link count changes. However, if the directory was deleted after moving files out, the move operation (rename) would update the files' 'c' timestamps. This is consistent with the scenario where files have a later 'c' timestamp and are in a recently deleted directory. The key is that the 'c' timestamp reflects metadata changes, not content modifications.

Answer

The files were accessed by a backup utility that updated the inode change time without modifying the file content or access time.

Answer

The files were deleted, and the deletion process updated the inode change time to reflect the deletion, but the modification and access timestamps remained unchanged.

Answer

The files were modified by a process that changed their extended attributes or ACLs, which updates the inode change time ('c') without altering the modification or access timestamps.

Question 3

An examiner is preparing to build a supertimeline from an NTFS volume using log2timeline/plaso and wants to ensure that file system-level events are captured with accurate timestamps. Which TWO of the following steps are necessary to correctly capture NTFS file system timeline events in the resulting plaso storage file? (Choose two.)

Accepted Answer

Run log2timeline with the winnt or ntfs parser enabled so $MFT, $UsnJrnl, and $LogFile artifacts are processed. Capturing an accurate NTFS file system timeline requires the NTFS parser so that MFT, USN journal, and $LogFile records are extracted, and it requires the correct source time zone so that FILETIME values are normalized to UTC without shift. Other options either do not affect parsing of NTFS file system events or actively remove valuable evidence. Ensuring parser selection and time zone correctness are the two essential steps for reliable timeline construction.

Answer

Disable the NTFS $FILE_NAME attribute parsing to avoid duplicate timestamps in the timeline

Answer

Convert the volume to a raw image using dd before processing to preserve slack space

Answer

Use the --vss_stores all option so that Volume Shadow Copy snapshots are included as separate timeline sources

Question 4

A forensic analyst is examining an ext4 file system image using The Sleuth Kit. They run `fls -r -m / -o 2048 /dev/sda1` and generate a body file, then use `mactime` to create a timeline. The analyst notices that several deleted files have inode numbers but no corresponding entries in the directory listing. Which ext4 feature is most directly responsible for the persistence of these deleted file inodes in the timeline?

Accepted Answer

Inode table. In ext4, the inode table is a fixed structure that holds metadata for all files, including deleted ones. When a file is deleted, its directory entry is removed, but the inode remains allocated until reused. The Sleuth Kit's `fls` can parse these inodes and include them in the body file, allowing analysts to reconstruct timelines that include deleted files. This is a fundamental aspect of ext4 file system forensics.

Answer

Extent trees

Answer

Directory entries

Answer

Journaling

Question 5

An analyst is examining an ext4 file system image and notices that a file's inode change time (ctime) is significantly later than its modification time (mtime). Which TWO of the following actions could explain this discrepancy? (Choose two.)

Accepted Answer

The file was renamed using mv within the same file system.. Changing permissions with chmod and renaming a file with mv both alter inode metadata without modifying file content, resulting in a ctime that is later than mtime. Content modifications update both times, and read operations update atime, not ctime. Extended attribute changes also update ctime but are less common than the other two.

Answer

The file was appended to using echo >>.

Answer

The file was read using cat.

Answer

The file's extended attributes were modified using setfattr.

Question 6

A forensic analyst is analyzing a Windows 10 system and wants to identify file system timeline artifacts that can reliably indicate when a file was last accessed. Which TWO of the following artifacts should the analyst examine? (Choose two.)

Accepted Answer

NTFS $STANDARD_INFORMATION attribute Last Access Time. The most reliable file system artifacts for determining file access times in NTFS are the $STANDARD_INFORMATION attribute's Last Access Time (when enabled) and the USN Journal ($LogFile) records (when access logging is enabled). These are directly tied to the file system and can provide precise timestamps. Other artifacts like Prefetch or Security event logs are not part of the file system metadata and may not always be present or enabled.

Answer

Windows Event Log Security auditing events (Event ID 4663)

Answer

Windows Prefetch files

Answer

NTFS $FILE_NAME attribute Last Access Time

Question 7

An analyst is analyzing a Windows 10 system and wants to determine when a specific file was last accessed. The file is located on an NTFS volume. The analyst checks the $STANDARD_INFORMATION attribute and sees an access timestamp of 2024-02-01 08:00:00. However, the $FILE_NAME attribute shows an access timestamp of 2024-01-15 12:00:00. The system has the default Windows 10 configuration for last access time updates. Which timestamp is more reliable for determining the last access time, and why?

Accepted Answer

The $STANDARD_INFORMATION access timestamp is more reliable because Windows 10 by default updates it on file access, whereas the $FILE_NAME access timestamp is not updated on access.. In Windows 10, the default configuration enables last access time updates on system volumes, but updates are deferred by up to one hour. The $STANDARD_INFORMATION access timestamp is updated on file access, while the $FILE_NAME access timestamp is not. Therefore, the $STANDARD_INFORMATION access timestamp is the more reliable indicator of last access time, though analysts should be aware of the potential delay.

Answer

The $FILE_NAME access timestamp is more reliable because it is updated only when the file is accessed, while the $STANDARD_INFORMATION access timestamp is updated on any metadata change.

Answer

Neither timestamp is reliable because Windows 10 disables last access time updates by default on all volumes.

Answer

Both timestamps are equally reliable because Windows 10 updates both the $STANDARD_INFORMATION and $FILE_NAME access timestamps on file access.

Question 8

An analyst is using The Sleuth Kit (TSK) to create a timeline from an NTFS image. They run 'fls -r -m C: image.dd > bodyfile.txt' and then 'mactime -b bodyfile.txt -d'. They notice that for a particular file, the timeline shows an entry for 'mac' times (modified, accessed, changed) but no 'b' (born) time. What is the most likely reason for the absence of the born time in the timeline?

Accepted Answer

The version of TSK used does not support extracting the $STANDARD_INFORMATION creation time, or the file's $STANDARD_INFORMATION attribute is missing or corrupted.. The absence of a born time in the mactime output typically indicates that TSK could not extract the $STANDARD_INFORMATION creation timestamp. This can occur if the TSK version does not support it, or if the attribute is missing or corrupted. Since the scenario specifies NTFS, the file system supports creation timestamps, so the issue is with the extraction or the attribute itself.

Answer

The file is a resident file, and TSK does not extract born time for resident files.

Answer

The file system is NTFS, and TSK's fls by default does not include the $STANDARD_INFORMATION creation time as 'born' time; it uses the $FILE_NAME creation time instead.

Answer

The file was created on a file system that does not support creation timestamps, such as FAT32.

Question 9

An analyst is building a file system timeline from an NTFS volume using The Sleuth Kit. They want to identify files that may have been timestomped. Which TWO of the following artifacts or techniques should they prioritize to detect potential timestamp manipulation? (Choose two.)

Accepted Answer

Compare $STANDARD_INFORMATION and $FILE_NAME timestamps for discrepancies.. Detecting timestomping in NTFS requires comparing $STANDARD_INFORMATION and $FILE_NAME timestamps, as many tools only alter the former. Additionally, the $LogFile can record timestamp changes, providing a secondary source of evidence. Together, these artifacts help analysts identify and corroborate timestamp manipulation, which is critical for maintaining timeline integrity.

Answer

Verify the file's sequence number in the $MFT record.

Answer

Check the $Bitmap for allocated clusters associated with the file.

Answer

Analyze the $UsnJrnl for file creation and modification records.

Question 10

During a forensic examination of an NTFS volume, an analyst discovers a file with the following timestamps: $STANDARD_INFORMATION creation: 2023-06-10 09:00:00, $STANDARD_INFORMATION modification: 2023-06-10 09:00:00, $FILE_NAME creation: 2023-06-10 09:00:00, $FILE_NAME modification: 2023-06-10 09:00:00. However, the $STANDARD_INFORMATION MFT change timestamp is 2023-06-11 10:00:00, and the $FILE_NAME MFT change timestamp is 2023-06-11 10:00:00. The MFT record header last modification time is 2023-06-11 10:00:00. Which of the following is the most likely explanation for the MFT change timestamps being later than the creation and modification timestamps?

Accepted Answer

The file's attributes were changed on 2023-06-11 10:00:00, updating the MFT change timestamps but not the creation or modification timestamps.. The MFT change timestamps in both $STANDARD_INFORMATION and $FILE_NAME are updated when the file's metadata changes, such as attribute modifications. Changing attributes like the read-only flag updates these MFT change timestamps without altering the creation or modification timestamps. This is consistent with the observed data where only the MFT change timestamps are later. Renaming or moving would also update other timestamps, so they are less likely.

Answer

The file's content was modified on 2023-06-11 10:00:00, updating the MFT change timestamps and the modification timestamp.

Answer

The file was moved to a different directory on 2023-06-11 10:00:00, updating the MFT change timestamps and the $FILE_NAME creation timestamp.

Answer

The file was renamed on 2023-06-11 10:00:00, which updated the MFT change timestamps but not the creation or modification timestamps.

Question 11

An analyst is examining an NTFS volume and finds a file with the following $STANDARD_INFORMATION timestamps: Created: 2024-02-01 08:00:00, Modified: 2024-02-01 08:00:00, MFT Modified: 2024-02-01 08:00:00, Accessed: 2024-02-01 08:00:00. The $FILE_NAME timestamps are: Created: 2024-02-01 08:00:00, Modified: 2024-02-01 08:00:00. The file's $MFT record sequence number is 1. The $LogFile shows no entries for this file. What is the most likely conclusion about this file?

Accepted Answer

The file was created on 2024-02-01 08:00:00 and has not been modified, accessed, or renamed since.. Uniform timestamps across both $STANDARD_INFORMATION and $FILE_NAME attributes, combined with a sequence number of 1 and no $LogFile entries, strongly indicate a file that was created and never modified. This pattern is common for files placed on the system and left untouched, and it does not suggest timestomping or other anti-forensic activity.

Answer

The file's timestamps have been timestomped to all match the same time.

Answer

The file was copied from another NTFS volume on 2024-02-01 08:00:00, preserving all timestamps.

Answer

The file's timestamps were altered by a tool that only modifies $STANDARD_INFORMATION, leaving $FILE_NAME timestamps unchanged.

Question 12

A forensic analyst is examining an NTFS volume and observes that a particular file's $STANDARD_INFORMATION MFT Change timestamp is significantly later than its $FILE_NAME MFT Change timestamp. The file is located in a user's Documents folder and is not a system file. What is the most likely explanation for this discrepancy?

Accepted Answer

The file's metadata was modified, such as a change in permissions or ownership, which updates the $STANDARD_INFORMATION MFT Change timestamp but does not affect the $FILE_NAME MFT Change timestamp.. The $STANDARD_INFORMATION MFT Change timestamp is updated when file metadata changes, such as permissions or ownership, while the $FILE_NAME MFT Change timestamp is updated on file creation, renaming, or moving. A later $STANDARD_INFORMATION MFT Change timestamp compared to $FILE_NAME MFT Change indicates a metadata modification event, which is common and not inherently suspicious. Analysts should consider this when interpreting timelines.

Answer

The file was moved from one folder to another on the same volume, which updates the $STANDARD_INFORMATION MFT Change timestamp but leaves the $FILE_NAME MFT Change timestamp unchanged.

Answer

The file was accessed by a user, which updates the $STANDARD_INFORMATION MFT Change timestamp but not the $FILE_NAME MFT Change timestamp.

Answer

The file was created with a different name and then renamed, which updates the $STANDARD_INFORMATION MFT Change timestamp but not the $FILE_NAME MFT Change timestamp.

Question 13

Refer to the exhibit. What can be inferred about the file activity?

Accepted Answer

The file was created and then populated with data.. The USN Journal logs multiple reasons for a single file entry. The 'File_Create' event followed by 'Data_Extend' indicates that a file was created and immediately populated with data. This is a common pattern for legitimate software installations or file writes. Identifying this sequence helps investigators differentiate between simple file creation and the actual writing of content, which is key to confirming if a file was just an empty shell or a functional payload.

Answer

The file was created and immediately deleted.

Answer

The file system is experiencing metadata corruption.

Answer

The timestamps reflect a timestomping attempt.

Question 14

Which TWO of the following actions are considered 'anti-forensic' techniques that directly impact file system timeline analysis?

Accepted Answer

Timestomping. Attackers utilize anti-forensic techniques to break the chain of evidence. Timestomping specifically invalidates the reliability of file metadata, while log clearing removes the context required for correlation. Both techniques force analysts to move deeper into secondary artifacts like the USN Journal or volume shadow copies, significantly increasing the time and complexity of an investigation while testing the analyst's ability to cross-reference multiple data sources for evidence.

Answer

Updating system drivers

Answer

Using a web browser

Answer

Renaming a file

Question 15

An analyst is examining a file that was deleted. Why is the 'File Name' (FN) attribute in the MFT still potentially readable?

Accepted Answer

NTFS does not zero out MFT records upon deletion.. When a file is deleted in NTFS, the MFT record is marked as free, but the data within the record is not immediately wiped or zeroed. The FN attribute remains in the MFT entry until the record is reallocated to a new file. This is a critical forensic detail because it allows analysts to recover metadata from deleted files, often providing the only remaining evidence of a file's existence after the data clusters have been overwritten.

Answer

The MFT entry is locked by the OS kernel.

Answer

The file was stored on a compressed volume.

Answer

The entry is hard-linked to another file.