GCFA File System Timeline Artifact Analysis — Timed 10 Questions

Question 1

An analyst is investigating an NTFS volume and notices that a file's $STANDARD_INFORMATION attribute modified timestamp is significantly earlier than its $FILE_NAME attribute modified timestamp. What is the most likely cause of this discrepancy during a forensic examination?

10 minute time limit — choose an answer to begin.

Accepted Answer

The file was copied to a new location within the same volume, causing $FILE_NAME to update while $STANDARD_INFORMATION was preserved.. Timestamp discrepancies between $STANDARD_INFORMATION and $FILE_NAME frequently occur when a file is copied or moved within the same NTFS volume. The copy operation creates new metadata where the $FILE_NAME is updated to the current time, while the $STANDARD_INFORMATION may retain copied or modified values depending on the specific user-space tool utilized.

Answer

The file was modified by the operating system kernel during a routine defragmentation pass.

Answer

An automated antivirus scanner accessed the file and updated the access time without altering metadata.

Answer

The system clock was manually adjusted backward by an attacker attempting to conceal malicious activity.

Question 2

An analyst is investigating a suspected malware execution. They notice the MFT entry for 'svchost.exe' shows a file creation time that is earlier than the MFT record modification time. Which artifact-based technique should the analyst employ to determine if a timestomp occurred?

Accepted Answer

Compare Standard Information (SI) attributes with File Name (FN) attributes.. Comparing standard information (SI) attributes with file name (FN) attributes is critical in NTFS forensics. When a file is moved or copied, the FN attribute reflects the original creation time, whereas the SI attribute is easily manipulated by user-mode APIs. Discrepancies between these two timestamps are a hallmark indicator of timestomping. This matters because attackers frequently modify metadata to hide their activities within the file system hierarchy, requiring analysts to cross-reference multiple MFT attributes for integrity validation.

Answer

Analyze the USN Journal for log gaps.

Answer

Examine the INDX records for file deletion.

Answer

Calculate the file hash and query VirusTotal.

Question 3

Which TWO of the following artifacts provide the most reliable evidence for reconstructing file system access history during a timeline analysis?

Accepted Answer

Shell Items (LNK Files). The Shell Items (LNK files) and the USN Journal are essential because they capture specific events rather than just static metadata. LNK files track user interaction and file paths, while the USN Journal provides a chronological log of file system changes. Relying on these prevents reliance on malleable metadata that attackers often exploit. Accurate timeline reconstruction requires correlation between user activity and underlying file system changes to prove specific malicious actions occurred.

Answer

MFT File Creation Timestamp

Answer

Registry 'LastWrite' times

Answer

File metadata (SI 'Modified' time)

Question 4

Refer to the exhibit. Based on the provided MFT attributes, what is the most likely conclusion regarding this file?

Accepted Answer

The file was timestomped to appear older than it is.. The exhibit shows a scenario where the SI creation time is earlier than the FN creation time. In standard Windows file operations, the FN attribute should be identical to or older than the SI attribute because FN is created during the file's birth. If SI is older than FN, it implies that the SI attribute was likely manually modified by an attacker, effectively 'timestomping' the file to predate its actual existence on the disk.

Answer

The file was moved from an NTFS partition to FAT32.

Answer

The file system encountered a cluster allocation error.

Answer

The operating system auto-updated the file metadata.

Question 5

When conducting a timeline analysis, which artifact is considered the most reliable source for determining when a file was actually deleted from an NTFS volume?

Accepted Answer

The $UsnJrnl (Update Sequence Number Journal).. The $LogFile and the $UsnJrnl are the primary sources for deletion events. While the MFT entry itself might be marked as free, the journal records contain transaction history that explicitly logs the deletion operation. Identifying the exact moment of deletion is critical for establishing a temporal boundary for attacker activities and determining what files were present during a specific window of time.

Answer

The MFT record's 'Deleted' flag.

Answer

The Recycle Bin's INFO2/index file.

Answer

Windows Event Log ID 4660.

Question 6

An analyst discovers a file with a 'Last Accessed' time that is significantly earlier than its 'Creation' time. What is the most appropriate forensic interpretation of this observation?

Accepted Answer

The file is a result of MFT record reuse.. In NTFS, the 'Last Accessed' time is often updated by search indexers, antivirus scanners, or anti-forensic tools. If the access time is earlier than the creation time, it suggests the MFT record was either timestomped or the record was reused by the OS for a new file while retaining remnants of the previous file's metadata in the access field. This is a common phenomenon that analysts must recognize to avoid misinterpreting file age.

Answer

The system clock was synchronized incorrectly.

Answer

An attacker manually changed the creation time.

Answer

The file was copied from an external drive.

Question 7

Which THREE of the following artifacts are commonly utilized to corroborate file system activity in a timeline analysis?

Accepted Answer

Prefetch Files. Correlation is the cornerstone of effective timeline analysis. By combining MFT records, event logs, and prefetch files, an analyst can verify if a file was merely present on the disk or if it was actively executed by a user or process. This triangulation mitigates the risk of relying on single, potentially manipulated data points, ensuring a robust and defensible reconstruction of events that transpired on the host.

Answer

BIOS/UEFI Time Settings

Answer

Volume Shadow Copies

Question 8

During a deep dive into an NTFS volume, you encounter a file where the $SI creation time is later than the $SI modification time. What does this indicate?

Accepted Answer

The file was likely moved or renamed.. This condition is often referred to as a 'birth-after-death' anomaly. It occurs when a file is moved within the same partition or modified in a way that causes the kernel to update the modification time but not the creation time, or vice-versa. Understanding these logical quirks is essential for forensic analysts to avoid incorrectly flagging benign system behaviors as malicious tampering or timestomping, which is common in complex NTFS environments.

Answer

The file has been actively timestomped.

Answer

The file is corrupted or fragmented.

Answer

The system clock was reset during an update.

Question 9

Which artifact is most useful for identifying the 'User' account associated with the creation of a specific file on a Windows system?

Accepted Answer

Security Event Logs (4624/4672).. Identifying the actor is just as important as identifying the action. Windows does not store the 'owner' in the MFT metadata in a way that tracks the creator's identity directly. Instead, analysts must correlate file creation times with security event logs (specifically Logon/Logoff events) or shell artifacts. This allows the investigator to map the file creation timestamp to a specific authenticated user session, which is necessary for attributing malicious actions to a specific threat actor.

Answer

The MFT File Owner SID.

Answer

The $LogFile transaction history.

Answer

The file's 'Last Accessed' time.

Question 10

When analyzing the $MFT, what is the significance of an entry having a sequence number of 1?

Accepted Answer

The MFT record has been reused once.. The sequence number in an MFT entry is incremented whenever a file record is reused. A sequence number of 1 indicates the record has been used very few times, suggesting a recently created file or a system that has not experienced significant file creation/deletion churn. This helps in understanding the lifespan of the file and whether the record is likely to have been recycled, which is crucial for determining the reliability of the metadata.

Answer

The file is a system-reserved protected file.

Answer

The file has been flagged for deletion.

Answer

The file is stored in a hidden directory.