GCFA Introduction to File System Timeline Forensics Practice Test 2 — 15 Questions

Question 1

A forensic analyst is examining a Windows 10 system and wants to build a comprehensive file system timeline. The analyst has already parsed the $MFT and USN journal. Which TWO additional artifacts should the analyst incorporate to most effectively correlate file system events with user and system activity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Event Logs (e.g., Security.evtx, System.evtx). The correct choices are Windows Event Logs and Registry hives. Event logs provide records of user logons, process executions, and system events that can be correlated with file system changes. Registry hives store user and system settings, including evidence of file access and program execution. Together, they enrich a file system timeline with context about user and system activity, enabling more accurate reconstruction of events.

Answer

Prefetch files

Answer

$LogFile

Answer

$UsnJrnl:$J

Question 2

A forensic analyst is examining an NTFS volume and observes that a file's $STANDARD_INFORMATION modification timestamp is 2023-08-15 14:00:00, while its $FILE_NAME modification timestamp is 2023-08-10 09:30:00. The file is a spreadsheet that the user claims was last edited on August 10. Which of the following best explains this discrepancy?

Accepted Answer

The $STANDARD_INFORMATION timestamp was modified by a user-mode API call such as SetFileTime.. In NTFS, the $STANDARD_INFORMATION attribute timestamps can be altered by user-mode APIs, whereas the $FILE_NAME attribute timestamps are maintained by the file system and are not changed by such calls. A later $STANDARD_INFORMATION modification time compared to $FILE_NAME suggests the file's timestamp was modified after the last legitimate edit, potentially to obscure activity.

Answer

The $STANDARD_INFORMATION timestamp is updated only when the file content changes, while $FILE_NAME is updated on metadata changes.

Answer

The $FILE_NAME timestamp reflects the time the file was last backed up.

Answer

The $FILE_NAME timestamp was updated by a file system tunneling operation.

Question 3

An analyst is examining an NTFS volume and finds that the $MFT record for a file shows a $STANDARD_INFORMATION modification time of 2024-03-10 08:00:00, but the $FILE_NAME modification time is 2024-03-09 22:00:00. The file's content is known to have been modified only once. Which of the following best explains this discrepancy?

Accepted Answer

The $STANDARD_INFORMATION modification time was altered by a user-mode API or tool, while the $FILE_NAME modification time reflects the original content modification.. The $STANDARD_INFORMATION timestamps are easily modified by user-mode APIs, while $FILE_NAME timestamps are updated by the file system during filename operations. A later $STANDARD_INFORMATION modification time with an earlier $FILE_NAME modification time suggests the former was tampered with. The $FILE_NAME timestamp is more likely to reflect the original content modification.

Answer

The system clock was adjusted backward after the file modification, causing the $FILE_NAME timestamp to be earlier.

Answer

The file was copied from another volume, and the $FILE_NAME timestamp retained the original creation time.

Answer

The file was renamed, which updated the $FILE_NAME modification time, but the content modification updated only the $STANDARD_INFORMATION modification time.

Question 4

An investigator is analyzing a Windows system and finds that a suspicious file has an NTFS $STANDARD_INFORMATION creation time of 2023-05-01 09:00:00, but the $FILE_NAME creation time is 2023-05-01 08:55:00. The file's $LogFile entries show that the file was created at 2023-05-01 08:50:00. Which timestamp is most likely the true creation time of the file?

Accepted Answer

The $LogFile creation time. The $LogFile records low-level file system transactions and is less prone to tampering than $STANDARD_INFORMATION or $FILE_NAME timestamps. Since it shows the earliest creation time and is consistent with a transactional record, it is the most reliable source for the true creation time.

Answer

The $FILE_NAME creation time

Answer

The average of the three timestamps

Answer

The $STANDARD_INFORMATION creation time

Question 5

An analyst is examining a timeline from a Windows 10 system and notices that a file's $FN creation timestamp is significantly earlier than its $SI creation timestamp. The file is located in a directory that was recently moved from another volume. What is the most likely explanation for this discrepancy?

Accepted Answer

The directory was moved across volumes, causing the $SI timestamps to be updated to the move time while the $FN timestamps retained the original creation time from the source volume.. In NTFS, when a file is moved across volumes, Windows treats it as a copy and delete operation. The new file on the destination volume receives new $STANDARD_INFORMATION timestamps (creation, modified, etc.) set to the time of the move. However, the $FILE_NAME timestamps are copied from the original file's $FN attribute, preserving the original creation time. This leads to a situation where the $FN creation time is earlier than the $SI creation time. This is a common forensic artifact indicating a cross-volume move, and analysts should recognize it to avoid misinterpretation.

Answer

The file was created on the source volume, then the system clock was rolled back before the move, causing the $SI timestamps to be later than the $FN timestamps.

Answer

The file's $SI timestamps were modified by a timestamping tool after the file was moved, while the $FN timestamps remained unchanged.

Answer

The file was copied using a tool that preserves $FN timestamps but updates $SI timestamps to the copy time.

Question 6

An investigator is analyzing an NTFS volume and notes that a critical file's last access timestamp is 2024-01-10, but the user claims the file was not opened after 2023-12-01. The system is running Windows 10 with default settings. Which factor most likely explains the discrepancy?

Accepted Answer

The last access timestamp was updated by a background process such as Windows Search indexing.. On Windows 10, last access time updates are disabled by default, but certain operations can still update it. Background processes like Windows Search indexing, antivirus scans, or backup software may access files, updating the last access timestamp. Therefore, a later last access time does not necessarily indicate user interaction, and the investigator should consider system activity.

Answer

Windows 10 disables last access time updates by default, so the timestamp is unreliable.

Answer

The file system tunneling feature updated the last access timestamp when the file was moved.

Answer

The $LogFile replayed a transaction that updated the last access timestamp.

Question 7

An analyst is preparing to create a file system timeline from a forensic image of an NTFS volume. The analyst wants to ensure the timeline includes timestamps from multiple sources to provide a comprehensive view of file system activity. Which TWO of the following artifacts should the analyst include to capture file creation, modification, and deletion events? (Choose two.)

Accepted Answer

$MFT. The $MFT provides the core file system timestamps for all files and directories, while the $UsnJrnl:$J records change events with timestamps and reasons. Together, they offer a comprehensive view of file creation, modification, and deletion activity. The other artifacts do not contain relevant timeline data.

Answer

$Bitmap

Answer

$LogFile

Answer

$Boot

Question 8

An analyst is constructing a file system timeline from an NTFS volume and wants to include NTFS change journal records to enrich the timeline with change reasons. The analyst plans to parse $UsnJrnl:$J directly from the image. Which two considerations are most important when interpreting these records in the timeline? (Choose two.)

Accepted Answer

USN journal records are stored in a sparse file, and the $J stream may contain sparse regions that must be handled to avoid misinterpreting zero-filled gaps as events.. When parsing $UsnJrnl:$J, the sparse nature of the stream means zero-filled gaps must be recognized and skipped to avoid false events. Additionally, the Reason field is a bitmask that can encode multiple change types in a single record, so decoding it correctly ensures each change is represented. These two considerations directly affect the accuracy of the timeline built from journal records.

Answer

The USN journal is stored in the $MFT and its records are updated only when the volume is mounted read-write, so a read-only acquisition will not capture them.

Answer

USN records use a monotonically increasing USN value that can be used to order events even if timestamps are identical, which is useful for sequencing rapid changes.

Answer

USN journal records contain full file content, allowing the analyst to recover deleted data directly from the journal.

Question 9

A forensic analyst is preparing to create a file system timeline from an NTFS image using TSK tools. The analyst wants to ensure the timeline includes both $STANDARD_INFORMATION and $FILE_NAME timestamps for all files. Which TWO steps should the analyst take to achieve this? (Choose two.)

Accepted Answer

Parse the bodyfile with mactime to produce a timeline that includes all timestamps present in the bodyfile.. To create a comprehensive timeline with both $STANDARD_INFORMATION and $FILE_NAME timestamps, the analyst must first generate a bodyfile using fls with the -m option, which includes all timestamps. Then, the analyst must process that bodyfile with mactime to produce the final timeline. The other options either do not affect timestamp inclusion or are unnecessary steps. Thus, the correct steps are using fls -m and then mactime.

Answer

Use the fls command with the -l option to include long format output that contains all timestamps.

Answer

Run fls with the -s option to display the full path for each file, which also enables $SI timestamp output.

Answer

Use the mactime tool with the -d option to generate a timeline that separates $SI and $FN timestamps.

Question 10

An analyst is building a bodyfile from a Windows 10 NTFS volume using The Sleuth Kit. The tool is run with the default settings against a mounted image. Several files show a $STANDARD_INFORMATION modified timestamp that is roughly one hour earlier than the corresponding $FILE_NAME modified timestamp. The system was configured with a local time zone of UTC+01:00 with daylight saving active. What is the most likely explanation for the observed offset?

Accepted Answer

The Sleuth Kit's bodyfile output applies a timezone conversion based on the host system's TZ setting, causing a one-hour shift relative to the raw FILETIME values.. The correct answer is the option describing The Sleuth Kit's timezone conversion. NTFS timestamps are stored in UTC, but forensic tools may apply the host's timezone settings when generating bodyfile output. A host configured for UTC+01:00 with daylight saving can introduce a one-hour offset in displayed times. Analysts must normalize timestamps to UTC to avoid confusion when correlating events across sources. Understanding the tool's timezone handling is essential for accurate timeline reconstruction.

Answer

The $FILE_NAME timestamps were updated by a directory entry change after the file content was last modified, and the $STANDARD_INFORMATION timestamps were preserved from an earlier state.

Answer

The $FILE_NAME attribute stores timestamps in UTC, while $STANDARD_INFORMATION stores them in local time, so the tool is reading the raw values without timezone normalization.

Answer

NTFS stores $STANDARD_INFORMATION timestamps in local time and $FILE_NAME timestamps in UTC, and the analyst must manually reconcile the difference during timeline creation.

Question 11

During a forensic investigation, an analyst generates a timeline from an NTFS image and observes that a file's $SI modified timestamp is 2024-04-01 10:00:00, while its $FN modified timestamp is 2024-04-01 09:55:00. The file is a log file that is actively being written to. Which of the following best explains the five-minute difference between the two timestamps?

Accepted Answer

The $SI modified timestamp is updated when the file's data changes, while the $FN modified timestamp is updated only when the file's name or directory entry changes.. In NTFS, the $STANDARD_INFORMATION modified time (mtime) is updated whenever the file's data is written. The $FILE_NAME modified time is updated only when the file's name or directory entry changes, such as during a rename or move. For an actively written log file, the $SI mtime will advance with each write, while the $FN mtime remains at the time of the last name-related operation. This explains why the $SI modified time is later than the $FN modified time. The other options misstate the update triggers or incorrectly attribute the difference to time zones or timestamping tools.

Answer

The file's $SI timestamps were modified by a timestamping tool, while the $FN timestamps were not, creating the discrepancy.

Answer

The $FN timestamps are stored in UTC, while $SI timestamps are stored in local time, causing an apparent offset.

Answer

The $FN timestamps are updated only when the file is closed, while $SI timestamps are updated on every write.

Question 12

A forensic analyst is examining a Windows 10 system and wants to build a comprehensive file system timeline. The analyst has already parsed the $MFT and USN journal. Which TWO additional artifacts should the analyst incorporate to most effectively correlate file system events with user and system activity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The $MFT record for the USB drive's mount point folder, which has a timestamp updated when the device is connected.. The correct answer is the option describing the $MFT record for the USB drive's mount point folder. When a USB device is connected, Windows may create or update a mount point folder, and the timestamps in its $MFT record can reflect the connection time. This file system artifact can corroborate registry and event log findings. While other artifacts like $LogFile and $UsnJrnl record file operations, they do not directly log device connections. The $MFT record for the mount point is a direct file system indicator of USB connection activity.

Answer

The $MFT record for the USB drive's volume serial number, which stores the last mount time in the $STANDARD_INFORMATION attribute.

Answer

The $UsnJrnl, which records changes to files and includes entries for USB device connections.

Answer

The $LogFile transaction records, which log every file system operation including device arrival and removal events.

Question 13

A forensic analyst is preparing to create a file system timeline from an NTFS volume using The Sleuth Kit. The analyst wants to ensure the timeline accurately reflects user activity and system events. Which TWO of the following practices should the analyst follow to avoid common pitfalls in timeline analysis? (Choose two.)

Accepted Answer

Include both allocated and unallocated MFT entries in the timeline to capture evidence of deleted files and historical activity.. The correct answers are normalizing timestamps to UTC and including both allocated and unallocated MFT entries. Normalizing to UTC prevents timezone-induced discrepancies, while including unallocated entries captures deleted file activity. These practices ensure a comprehensive and accurate timeline. Relying solely on $STANDARD_INFORMATION, excluding $FILE_NAME timestamps, or assuming all timestamps are accurate without validation are pitfalls that can lead to incomplete or misleading conclusions. Analysts should use multiple artifacts and cross-validation to build a reliable timeline.

Answer

Rely solely on the $STANDARD_INFORMATION timestamps because they are always the most accurate and cannot be manipulated.

Answer

Assume that all timestamps are accurate and do not require validation against other sources such as event logs or registry artifacts.

Answer

Exclude all timestamps from the $FILE_NAME attribute because they are redundant with $STANDARD_INFORMATION and can cause confusion.

Question 14

During a forensic investigation of an NTFS volume, an analyst notices that the $MFT record for a suspicious executable shows a modified time earlier than its creation time. What does this specific anomaly typically indicate?

Accepted Answer

The file was copied from another location, preserving the original modified timestamp while generating a new creation timestamp.. An $MFT record reflecting a modified time earlier than the creation time frequently occurs when a file is copied rather than moved. The copy operation assigns a new creation timestamp to the destination file while preserving the original modified timestamp from the source file. Recognizing this artifact helps forensic analysts trace the origin of stolen payloads across network shares or external drives.

Answer

The file system metadata was actively corrupted by malware to hinder timeline analysis.

Answer

The operating system experienced a severe clock synchronization failure during the write operation.

Answer

An automated defragmentation utility reorganized the cluster chain and inadvertently swapped the metadata values.

Question 15

An incident responder is building a MACB timeline from an ext4 file system using the Sleuth Kit. Why might the resulting timeline display execution timestamps or access times that appear unreliable for establishing user activity?

Accepted Answer

Mount options such as relatime or noatime suppress continuous updates to file access timestamps to improve performance.. The ext4 file system supports the noatime mount option, which disables the updating of access times whenever files are read. This optimization significantly reduces disk I/O overhead but blinds investigators to critical file access timelines, making it difficult to prove whether a specific binary was actually executed by a local user.

Answer

The ext4 journal aggressively overwrites inode metadata before user-space tools can parse the raw blocks.

Answer

The operating system automatically randomizes inode timestamps every 24 hours to prevent precise profiling.

Answer

The Sleuth Kit parser inherently misinterprets the 64-bit epoch time structures utilized by modern Linux kernels.