GCFA Introduction to File System Timeline Forensics — All Questions With Answers

Question 1mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO file system artifacts or parameters are critical for an analyst to examine when evaluating the reliability of NTFS $STANDARD_INFORMATION and $FILE_NAME attribute timestamps during a timeline analysis? (Choose two)

Question 2mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is reviewing a timeline generated from a compromised Windows workstation and notices a high volume of file accesses to various user documents immediately preceded by the creation of a prefetch file for a known archive utility. What forensic deduction can be made from this timeline sequence?

Question 3mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO limitations or challenges should a forensic investigator keep in mind when relying on file system timelines to reconstruct user activity? (Choose two)

Question 4mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is investigating an unauthorized file modification on an NTFS volume. Which set of timestamps provides the most reliable indicator of actual file content changes rather than metadata updates?

Question 5hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO of the following accurately describe the limitations of using MACB (Modified, Accessed, Changed, Birth) timelines in forensic investigations?

Question 6mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which artifact is most useful for verifying file access if the file system 'atime' is disabled?

Question 7hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which THREE of the following are valid reasons to include system event logs in a file system timeline?

Question 8mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which action most effectively minimizes the risk of altering file system metadata during live forensic data collection?

Question 9hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which THREE of the following represent common challenges when performing timeline analysis on a system with multiple time zones?

Question 10hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO of the following actions typically result in the update of the $Standard_Information attribute in an NTFS file system?

Question 11mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Refer to the exhibit. An analyst generated a timeline using the Sleuth Kit. What is the primary purpose of creating the bodyfile in this workflow?

Exhibit

C:\> fls -r -m C:/ C: > bodyfile.txt
C:\> mactime -b bodyfile.txt 2023-01-01..2023-01-31 > timeline.csv

Question 12hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which THREE of the following represent potential weaknesses when relying exclusively on system timestamps for forensic timelines?

Question 13hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Refer to the exhibit. An investigator observes a discrepancy between the $Standard_Information and $File_Name timestamps in an NTFS MFT record. What is the most likely explanation for this difference?

Exhibit

MFT Entry: 12345
$Standard_Information: 2023-05-01 10:00:00
$File_Name: 2023-05-01 12:00:00

Question 14hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a compromised Linux server and needs to build a timeline of file system activity. The server uses ext4. The investigator runs the command 'debugfs -R "stat /etc/passwd" /dev/sda1' and observes the following timestamps: ctime: 2024-02-10 08:15:32, atime: 2024-02-11 09:20:45, mtime: 2024-02-10 08:15:32, crtime: 2024-01-05 10:00:00. The investigator also notes that the file's inode number is 12345. Which of the following is the most accurate interpretation of these timestamps for timeline reconstruction?

Question 15mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is investigating a compromised Windows Server 2016 system. During timeline analysis, the analyst notices that several executable files in the C:\Windows\Temp directory have $STANDARD_INFORMATION modification times that are earlier than their $FILE_NAME modification times. What is the most likely explanation for this discrepancy?

Question 16mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining a Windows 10 system and wants to build a comprehensive file system timeline. The analyst has already parsed the $MFT and USN journal. Which TWO additional artifacts should the analyst incorporate to most effectively correlate file system events with user and system activity? (Choose two.)

Question 17mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining an NTFS volume and observes that a file's $STANDARD_INFORMATION modification timestamp is 2023-08-15 14:00:00, while its $FILE_NAME modification timestamp is 2023-08-10 09:30:00. The file is a spreadsheet that the user claims was last edited on August 10. Which of the following best explains this discrepancy?

Question 18hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is examining an NTFS volume and finds that the $MFT record for a file shows a $STANDARD_INFORMATION modification time of 2024-03-10 08:00:00, but the $FILE_NAME modification time is 2024-03-09 22:00:00. The file's content is known to have been modified only once. Which of the following best explains this discrepancy?

Question 19hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a Windows system and finds that a suspicious file has an NTFS $STANDARD_INFORMATION creation time of 2023-05-01 09:00:00, but the $FILE_NAME creation time is 2023-05-01 08:55:00. The file's $LogFile entries show that the file was created at 2023-05-01 08:50:00. Which timestamp is most likely the true creation time of the file?

Question 20hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is examining a timeline from a Windows 10 system and notices that a file's $FN creation timestamp is significantly earlier than its $SI creation timestamp. The file is located in a directory that was recently moved from another volume. What is the most likely explanation for this discrepancy?

Question 21hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing an NTFS volume and notes that a critical file's last access timestamp is 2024-01-10, but the user claims the file was not opened after 2023-12-01. The system is running Windows 10 with default settings. Which factor most likely explains the discrepancy?

Question 22mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is preparing to create a file system timeline from a forensic image of an NTFS volume. The analyst wants to ensure the timeline includes timestamps from multiple sources to provide a comprehensive view of file system activity. Which TWO of the following artifacts should the analyst include to capture file creation, modification, and deletion events? (Choose two.)

Question 23hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is constructing a file system timeline from an NTFS volume and wants to include NTFS change journal records to enrich the timeline with change reasons. The analyst plans to parse $UsnJrnl:$J directly from the image. Which two considerations are most important when interpreting these records in the timeline? (Choose two.)

Question 24mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is preparing to create a file system timeline from an NTFS image using TSK tools. The analyst wants to ensure the timeline includes both $STANDARD_INFORMATION and $FILE_NAME timestamps for all files. Which TWO steps should the analyst take to achieve this? (Choose two.)

Question 25mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is building a bodyfile from a Windows 10 NTFS volume using The Sleuth Kit. The tool is run with the default settings against a mounted image. Several files show a $STANDARD_INFORMATION modified timestamp that is roughly one hour earlier than the corresponding $FILE_NAME modified timestamp. The system was configured with a local time zone of UTC+01:00 with daylight saving active. What is the most likely explanation for the observed offset?

Question 26mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation, an analyst generates a timeline from an NTFS image and observes that a file's $SI modified timestamp is 2024-04-01 10:00:00, while its $FN modified timestamp is 2024-04-01 09:55:00. The file is a log file that is actively being written to. Which of the following best explains the five-minute difference between the two timestamps?

Question 27mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining a Windows 10 system and needs to determine when a specific USB drive was last connected. The analyst has already parsed the registry and event logs but wants to corroborate the findings using file system metadata. Which file system artifact would provide the most direct evidence of the USB drive's last connection time?

Question 28hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is preparing to create a file system timeline from an NTFS volume using The Sleuth Kit. The analyst wants to ensure the timeline accurately reflects user activity and system events. Which TWO of the following practices should the analyst follow to avoid common pitfalls in timeline analysis? (Choose two.)

Question 29mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation of an NTFS volume, an analyst notices that the $MFT record for a suspicious executable shows a modified time earlier than its creation time. What does this specific anomaly typically indicate?

Question 30hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An incident responder is building a MACB timeline from an ext4 file system using the Sleuth Kit. Why might the resulting timeline display execution timestamps or access times that appear unreliable for establishing user activity?

Question 31mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

When creating a super-timeline using tools like log2timeline, why is it critical to filter the output data?

Question 32mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator notices that a file's 'Birth' time is later than its 'Modification' time. What is the most likely forensic explanation for this phenomenon?

Question 33easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

In the context of forensic timeline analysis, what does the term 'Time Skew' refer to?

Question 34mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

What is the primary function of the $LogFile in NTFS when reconstructing a timeline?

Question 35easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Why should a forensic analyst avoid using the 'Last Accessed' time as the primary indicator for a file's usage?

Question 36mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which of these is the primary limitation of using a file system 'Birth' time as a definitive event marker?

Question 37mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is examining an NTFS volume and notices that a file's MFT entry shows a modification time earlier than its creation time. What is the most likely cause for this anomaly?

Question 38mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

When performing timeline analysis on a Linux system, which file is the most critical to examine to reconstruct user login and logout history?

Question 39easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which of the following describes the 'MAC' in MACB times during timeline analysis?

Question 40mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Why might an analyst prefer using 'Super-Timeline' creation tools, such as log2timeline, over manual collection of file system timestamps?

Question 41mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation of a Windows 10 workstation, an analyst reviews the NTFS Master File Table (MFT) and notices that the $STANDARD_INFORMATION timestamps for a suspicious file are all dated 2023-08-15, but the $FILE_NAME timestamps are dated 2024-01-20. The file is located in C:\Users\Public\Downloads. Which of the following best explains this discrepancy?

Question 42easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst acquires a forensic image of a Windows 10 NTFS volume using a write blocker and now needs to build a file system timeline. The analyst wants to include the $STANDARD_INFORMATION timestamps but also wants to detect timestomping by comparing them with the $FILE_NAME timestamps. Which tool should the analyst use to extract both timestamp sets from the MFT and generate a bodyfile for timeline creation?

Question 43easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining a Linux ext4 file system and wants to determine when a file's metadata (such as permissions or ownership) was last changed. Which timestamp should they examine?

Question 44easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is preparing to analyze a Windows 10 workstation's NTFS volume using a forensic tool that reads the master file table (MFT) directly. The goal is to build a timeline that includes timestamps for files that were deleted before the acquisition. Which artifact should the investigator primarily rely on to recover timestamps for deleted files?

Question 45hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a Windows 10 system and needs to correlate file system timestamps with other artifacts to build a comprehensive timeline. Which two of the following Windows artifacts can provide additional temporal context when combined with NTFS timestamps? (Choose two.)

Question 46mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is building a file system timeline for an NTFS volume from a Windows 10 workstation. The user claims a file was copied to an external drive at 14:00, but the file's NTFS Standard Information Attribute shows only a modification timestamp of 13:45. Which NTFS artifact should the investigator examine to determine when the filename was actually created or renamed on the volume?

Question 47mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic examination of an NTFS volume, an analyst notices that a file's $STANDARD_INFORMATION timestamps show a modification time of 2023-04-01 10:00:00, but the $FILE_NAME timestamps show a modification time of 2023-03-15 14:30:00. The file is not a system file and has not been renamed. What is the most likely explanation for this discrepancy?

Question 48mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is adding NTFS USN change journal records to a file system timeline on a Windows 10 workstation. The journal was captured live with fsutil usn readjournal and shows a record with Reason value 0x00000100 (DATA_OVERWRITE) for a user document. The investigator wants to determine whether the file content was actually altered at that moment. Which statement best describes what the USN record establishes?

Question 49easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is building a timeline from an NTFS volume and wants to include the time when a file's metadata was last changed, such as permission modifications. Which timestamp should the analyst focus on to capture this event?

Question 50easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is building a file system timeline from an NTFS volume and is deciding which timestamps to extract from the $STANDARD_INFORMATION attribute. A colleague suggests that the four timestamps in $STANDARD_INFORMATION are the only relevant times. Which statement correctly describes the relationship between $STANDARD_INFORMATION and $FILE_NAME timestamps?

Question 51hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation of a Windows 10 system, an analyst observes that a file's $STANDARD_INFORMATION creation timestamp is 2020-01-01 10:00:00, while its $FILE_NAME creation timestamp is 2020-01-01 10:00:05. The system time zone is UTC-5. The analyst also notes that the file's $STANDARD_INFORMATION modification timestamp is 2020-01-01 10:00:00. What is the most likely explanation for the 5-second difference between the creation timestamps?

Question 52mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is creating a timeline from a Windows 10 workstation using fls and mactime from The Sleuth Kit. The analyst notices that the bodyfile contains entries with timestamps that appear to be off by several hours compared to the wall-clock time the incident was reported. The system is known to be set to UTC in the BIOS. Which action best ensures the timeline is correctly aligned for reporting?

Question 53hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a timeline review of an NTFS volume, an analyst observes that a file's $STANDARD_INFORMATION modification time is several days earlier than its $FILE_NAME modification time, and the $STANDARD_INFORMATION creation time is also earlier than the $FILE_NAME creation time. The file is a suspected malware dropper. Which conclusion is best supported by this pattern?

Question 54easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is using a tool to generate a file system timeline from an NTFS volume. The tool outputs timestamps with nanosecond precision, but the analyst knows that NTFS stores timestamps with 100-nanosecond resolution. What is the most likely reason for the discrepancy?

Question 55mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is building a file system timeline from an NTFS volume and wants to ensure it includes reliable evidence of file creation and deletion events. Which two artifacts should the analyst prioritize to capture these events? (Choose two.)

Question 56mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a Linux ext4 file system and needs to determine when a file's content was last modified. The file's inode contains ctime, mtime, and atime fields. Which timestamp should the investigator use to answer this specific question?

Question 57hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining an NTFS volume and wants to identify potential timestomping. Which TWO artifacts should the analyst compare to detect inconsistencies in file timestamps? (Choose two.)

Question 58hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing an NTFS volume from a Windows Server 2016 system that was recently compromised. The attacker used a tool to modify file timestamps to evade detection. The investigator notices that the $STANDARD_INFORMATION timestamps for a suspicious executable are all set to 2018-01-01, while the $FILE_NAME timestamps remain at 2021-06-15. The $MFT entry number is 12345. What is the most accurate conclusion regarding the timestamp manipulation?

Question 59easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is creating a timeline from a forensic image of a Windows 7 system using The Sleuth Kit's fls and mactime tools. The analyst notices that the timeline includes entries for files that no longer exist on the volume. Which NTFS artifact is most likely responsible for these entries, and how should the analyst interpret them?

Question 1mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO file system artifacts or parameters are critical for an analyst to examine when evaluating the reliability of NTFS $STANDARD_INFORMATION and $FILE_NAME attribute timestamps during a timeline analysis? (Choose two)

Question 2mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is reviewing a timeline generated from a compromised Windows workstation and notices a high volume of file accesses to various user documents immediately preceded by the creation of a prefetch file for a known archive utility. What forensic deduction can be made from this timeline sequence?

Question 3mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO limitations or challenges should a forensic investigator keep in mind when relying on file system timelines to reconstruct user activity? (Choose two)

Question 4mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is investigating an unauthorized file modification on an NTFS volume. Which set of timestamps provides the most reliable indicator of actual file content changes rather than metadata updates?

Question 5hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO of the following accurately describe the limitations of using MACB (Modified, Accessed, Changed, Birth) timelines in forensic investigations?

Question 6mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which artifact is most useful for verifying file access if the file system 'atime' is disabled?

Question 7hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which THREE of the following are valid reasons to include system event logs in a file system timeline?

Question 8mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which action most effectively minimizes the risk of altering file system metadata during live forensic data collection?

Question 9hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which THREE of the following represent common challenges when performing timeline analysis on a system with multiple time zones?

Question 10hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which TWO of the following actions typically result in the update of the $Standard_Information attribute in an NTFS file system?

Question 11mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Refer to the exhibit. An analyst generated a timeline using the Sleuth Kit. What is the primary purpose of creating the bodyfile in this workflow?

Exhibit

C:\> fls -r -m C:/ C: > bodyfile.txt
C:\> mactime -b bodyfile.txt 2023-01-01..2023-01-31 > timeline.csv

Question 12hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

Which THREE of the following represent potential weaknesses when relying exclusively on system timestamps for forensic timelines?

Question 13hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Refer to the exhibit. An investigator observes a discrepancy between the $Standard_Information and $File_Name timestamps in an NTFS MFT record. What is the most likely explanation for this difference?

Exhibit

MFT Entry: 12345
$Standard_Information: 2023-05-01 10:00:00
$File_Name: 2023-05-01 12:00:00

Question 14hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a compromised Linux server and needs to build a timeline of file system activity. The server uses ext4. The investigator runs the command 'debugfs -R "stat /etc/passwd" /dev/sda1' and observes the following timestamps: ctime: 2024-02-10 08:15:32, atime: 2024-02-11 09:20:45, mtime: 2024-02-10 08:15:32, crtime: 2024-01-05 10:00:00. The investigator also notes that the file's inode number is 12345. Which of the following is the most accurate interpretation of these timestamps for timeline reconstruction?

Question 15mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is investigating a compromised Windows Server 2016 system. During timeline analysis, the analyst notices that several executable files in the C:\Windows\Temp directory have $STANDARD_INFORMATION modification times that are earlier than their $FILE_NAME modification times. What is the most likely explanation for this discrepancy?

Question 16mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining a Windows 10 system and wants to build a comprehensive file system timeline. The analyst has already parsed the $MFT and USN journal. Which TWO additional artifacts should the analyst incorporate to most effectively correlate file system events with user and system activity? (Choose two.)

Question 17mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining an NTFS volume and observes that a file's $STANDARD_INFORMATION modification timestamp is 2023-08-15 14:00:00, while its $FILE_NAME modification timestamp is 2023-08-10 09:30:00. The file is a spreadsheet that the user claims was last edited on August 10. Which of the following best explains this discrepancy?

Question 18hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is examining an NTFS volume and finds that the $MFT record for a file shows a $STANDARD_INFORMATION modification time of 2024-03-10 08:00:00, but the $FILE_NAME modification time is 2024-03-09 22:00:00. The file's content is known to have been modified only once. Which of the following best explains this discrepancy?

Question 19hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a Windows system and finds that a suspicious file has an NTFS $STANDARD_INFORMATION creation time of 2023-05-01 09:00:00, but the $FILE_NAME creation time is 2023-05-01 08:55:00. The file's $LogFile entries show that the file was created at 2023-05-01 08:50:00. Which timestamp is most likely the true creation time of the file?

Question 20hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is examining a timeline from a Windows 10 system and notices that a file's $FN creation timestamp is significantly earlier than its $SI creation timestamp. The file is located in a directory that was recently moved from another volume. What is the most likely explanation for this discrepancy?

Question 21hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing an NTFS volume and notes that a critical file's last access timestamp is 2024-01-10, but the user claims the file was not opened after 2023-12-01. The system is running Windows 10 with default settings. Which factor most likely explains the discrepancy?

Question 22mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is preparing to create a file system timeline from a forensic image of an NTFS volume. The analyst wants to ensure the timeline includes timestamps from multiple sources to provide a comprehensive view of file system activity. Which TWO of the following artifacts should the analyst include to capture file creation, modification, and deletion events? (Choose two.)

Question 23hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is constructing a file system timeline from an NTFS volume and wants to include NTFS change journal records to enrich the timeline with change reasons. The analyst plans to parse $UsnJrnl:$J directly from the image. Which two considerations are most important when interpreting these records in the timeline? (Choose two.)

Question 24mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is preparing to create a file system timeline from an NTFS image using TSK tools. The analyst wants to ensure the timeline includes both $STANDARD_INFORMATION and $FILE_NAME timestamps for all files. Which TWO steps should the analyst take to achieve this? (Choose two.)

Question 25mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is building a bodyfile from a Windows 10 NTFS volume using The Sleuth Kit. The tool is run with the default settings against a mounted image. Several files show a $STANDARD_INFORMATION modified timestamp that is roughly one hour earlier than the corresponding $FILE_NAME modified timestamp. The system was configured with a local time zone of UTC+01:00 with daylight saving active. What is the most likely explanation for the observed offset?

Question 26mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation, an analyst generates a timeline from an NTFS image and observes that a file's $SI modified timestamp is 2024-04-01 10:00:00, while its $FN modified timestamp is 2024-04-01 09:55:00. The file is a log file that is actively being written to. Which of the following best explains the five-minute difference between the two timestamps?

Question 27mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining a Windows 10 system and needs to determine when a specific USB drive was last connected. The analyst has already parsed the registry and event logs but wants to corroborate the findings using file system metadata. Which file system artifact would provide the most direct evidence of the USB drive's last connection time?

Question 28hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is preparing to create a file system timeline from an NTFS volume using The Sleuth Kit. The analyst wants to ensure the timeline accurately reflects user activity and system events. Which TWO of the following practices should the analyst follow to avoid common pitfalls in timeline analysis? (Choose two.)

Question 29mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation of an NTFS volume, an analyst notices that the $MFT record for a suspicious executable shows a modified time earlier than its creation time. What does this specific anomaly typically indicate?

Question 30hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An incident responder is building a MACB timeline from an ext4 file system using the Sleuth Kit. Why might the resulting timeline display execution timestamps or access times that appear unreliable for establishing user activity?

Question 31mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

When creating a super-timeline using tools like log2timeline, why is it critical to filter the output data?

Question 32mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator notices that a file's 'Birth' time is later than its 'Modification' time. What is the most likely forensic explanation for this phenomenon?

Question 33easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

In the context of forensic timeline analysis, what does the term 'Time Skew' refer to?

Question 34mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

What is the primary function of the $LogFile in NTFS when reconstructing a timeline?

Question 35easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Why should a forensic analyst avoid using the 'Last Accessed' time as the primary indicator for a file's usage?

Question 36mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which of these is the primary limitation of using a file system 'Birth' time as a definitive event marker?

Question 37mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is examining an NTFS volume and notices that a file's MFT entry shows a modification time earlier than its creation time. What is the most likely cause for this anomaly?

Question 38mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

When performing timeline analysis on a Linux system, which file is the most critical to examine to reconstruct user login and logout history?

Question 39easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Which of the following describes the 'MAC' in MACB times during timeline analysis?

Question 40mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

Why might an analyst prefer using 'Super-Timeline' creation tools, such as log2timeline, over manual collection of file system timestamps?

Question 41mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation of a Windows 10 workstation, an analyst reviews the NTFS Master File Table (MFT) and notices that the $STANDARD_INFORMATION timestamps for a suspicious file are all dated 2023-08-15, but the $FILE_NAME timestamps are dated 2024-01-20. The file is located in C:\Users\Public\Downloads. Which of the following best explains this discrepancy?

Question 42easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst acquires a forensic image of a Windows 10 NTFS volume using a write blocker and now needs to build a file system timeline. The analyst wants to include the $STANDARD_INFORMATION timestamps but also wants to detect timestomping by comparing them with the $FILE_NAME timestamps. Which tool should the analyst use to extract both timestamp sets from the MFT and generate a bodyfile for timeline creation?

Question 43easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining a Linux ext4 file system and wants to determine when a file's metadata (such as permissions or ownership) was last changed. Which timestamp should they examine?

Question 44easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is preparing to analyze a Windows 10 workstation's NTFS volume using a forensic tool that reads the master file table (MFT) directly. The goal is to build a timeline that includes timestamps for files that were deleted before the acquisition. Which artifact should the investigator primarily rely on to recover timestamps for deleted files?

Question 45hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a Windows 10 system and needs to correlate file system timestamps with other artifacts to build a comprehensive timeline. Which two of the following Windows artifacts can provide additional temporal context when combined with NTFS timestamps? (Choose two.)

Question 46mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is building a file system timeline for an NTFS volume from a Windows 10 workstation. The user claims a file was copied to an external drive at 14:00, but the file's NTFS Standard Information Attribute shows only a modification timestamp of 13:45. Which NTFS artifact should the investigator examine to determine when the filename was actually created or renamed on the volume?

Question 47mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic examination of an NTFS volume, an analyst notices that a file's $STANDARD_INFORMATION timestamps show a modification time of 2023-04-01 10:00:00, but the $FILE_NAME timestamps show a modification time of 2023-03-15 14:30:00. The file is not a system file and has not been renamed. What is the most likely explanation for this discrepancy?

Question 48mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is adding NTFS USN change journal records to a file system timeline on a Windows 10 workstation. The journal was captured live with fsutil usn readjournal and shows a record with Reason value 0x00000100 (DATA_OVERWRITE) for a user document. The investigator wants to determine whether the file content was actually altered at that moment. Which statement best describes what the USN record establishes?

Question 49easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is building a timeline from an NTFS volume and wants to include the time when a file's metadata was last changed, such as permission modifications. Which timestamp should the analyst focus on to capture this event?

Question 50easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is building a file system timeline from an NTFS volume and is deciding which timestamps to extract from the $STANDARD_INFORMATION attribute. A colleague suggests that the four timestamps in $STANDARD_INFORMATION are the only relevant times. Which statement correctly describes the relationship between $STANDARD_INFORMATION and $FILE_NAME timestamps?

Question 51hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a forensic investigation of a Windows 10 system, an analyst observes that a file's $STANDARD_INFORMATION creation timestamp is 2020-01-01 10:00:00, while its $FILE_NAME creation timestamp is 2020-01-01 10:00:05. The system time zone is UTC-5. The analyst also notes that the file's $STANDARD_INFORMATION modification timestamp is 2020-01-01 10:00:00. What is the most likely explanation for the 5-second difference between the creation timestamps?

Question 52mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is creating a timeline from a Windows 10 workstation using fls and mactime from The Sleuth Kit. The analyst notices that the bodyfile contains entries with timestamps that appear to be off by several hours compared to the wall-clock time the incident was reported. The system is known to be set to UTC in the BIOS. Which action best ensures the timeline is correctly aligned for reporting?

Question 53hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

During a timeline review of an NTFS volume, an analyst observes that a file's $STANDARD_INFORMATION modification time is several days earlier than its $FILE_NAME modification time, and the $STANDARD_INFORMATION creation time is also earlier than the $FILE_NAME creation time. The file is a suspected malware dropper. Which conclusion is best supported by this pattern?

Question 54easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is using a tool to generate a file system timeline from an NTFS volume. The tool outputs timestamps with nanosecond precision, but the analyst knows that NTFS stores timestamps with 100-nanosecond resolution. What is the most likely reason for the discrepancy?

Question 55mediummulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is building a file system timeline from an NTFS volume and wants to ensure it includes reliable evidence of file creation and deletion events. Which two artifacts should the analyst prioritize to capture these events? (Choose two.)

Question 56mediummultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing a Linux ext4 file system and needs to determine when a file's content was last modified. The file's inode contains ctime, mtime, and atime fields. Which timestamp should the investigator use to answer this specific question?

Question 57hardmulti select

Read the full Introduction to File System Timeline Forensics explanation →

A forensic analyst is examining an NTFS volume and wants to identify potential timestomping. Which TWO artifacts should the analyst compare to detect inconsistencies in file timestamps? (Choose two.)

Question 58hardmultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An investigator is analyzing an NTFS volume from a Windows Server 2016 system that was recently compromised. The attacker used a tool to modify file timestamps to evade detection. The investigator notices that the $STANDARD_INFORMATION timestamps for a suspicious executable are all set to 2018-01-01, while the $FILE_NAME timestamps remain at 2021-06-15. The $MFT entry number is 12345. What is the most accurate conclusion regarding the timestamp manipulation?

Question 59easymultiple choice

Read the full Introduction to File System Timeline Forensics explanation →

An analyst is creating a timeline from a forensic image of a Windows 7 system using The Sleuth Kit's fls and mactime tools. The analyst notices that the timeline includes entries for files that no longer exist on the volume. Which NTFS artifact is most likely responsible for these entries, and how should the analyst interpret them?