GCFA Introduction to File System Timeline Forensics Practice Test 3 — 15 Questions

Question 1

When creating a super-timeline using tools like log2timeline, why is it critical to filter the output data?

Accepted Answer

Filtering isolates relevant events from the massive volume of benign system activity. Super-timelines ingest massive amounts of data from diverse sources, including system logs, web history, and file system metadata. Without filtering, the volume of 'noise' from routine system activity makes it nearly impossible to isolate the specific events relevant to an incident. Filtering allows the investigator to focus on anomalous patterns and specific time windows, drastically increasing the efficiency and accuracy of the forensic reconstruction process during a high-pressure investigation.

Answer

Filtering increases the precision of the file system's internal clock

Answer

Filtering removes redundant entries to prevent system crashes during analysis

Answer

Filtering is required to encrypt the timeline output for secure storage

Question 2

An investigator notices that a file's 'Birth' time is later than its 'Modification' time. What is the most likely forensic explanation for this phenomenon?

Accepted Answer

The file was copied from an external source. This scenario, often called 'time-traveling' files, typically occurs when a file is copied from another location. The copy process assigns a new 'Birth' time (the time of the copy), but the 'Modification' time is often preserved from the original source file. Recognizing this artifact is crucial for distinguishing between files created locally and those that were moved or copied by an attacker into the environment during an incident.

Answer

The file system is corrupted

Answer

The system clock was updated via NTP

Answer

The file is a system-level shadow copy

Question 3

In the context of forensic timeline analysis, what does the term 'Time Skew' refer to?

Accepted Answer

The discrepancy between the system clock and the actual time. Time skew is the difference between the actual wall-clock time and the time reported by the system under investigation. Identifying and correcting for this skew is a fundamental prerequisite for timeline analysis. If the investigator ignores the skew, all events will be chronologically misaligned, making it impossible to correlate evidence across different machines or correlate logs with file system activity during the incident reconstruction phase.

Answer

The difference between local time and UTC

Answer

The intentional modification of a file's timestamp

Answer

The process of normalizing timestamps to a common format

Question 4

What is the primary function of the $LogFile in NTFS when reconstructing a timeline?

Accepted Answer

To record metadata transactions for file system integrity. The $LogFile is a circular buffer that records metadata transactions for the file system. It is invaluable for forensic analysts because it captures recent changes to the file system, including those that might not yet be committed to the MFT. By parsing the $LogFile, investigators can recover evidence of file creations, deletions, or renames that occurred shortly before an incident, providing a granular view of recent activity that might otherwise be lost.

Answer

To store the actual file content data for quick retrieval

Answer

To track all user-level file access and modification events

Answer

To store backup copies of the Master File Table

Question 5

Why should a forensic analyst avoid using the 'Last Accessed' time as the primary indicator for a file's usage?

Accepted Answer

It is unreliable due to frequent updates by system services. The 'Last Accessed' timestamp is notoriously unreliable in forensic analysis because it is frequently updated by non-human system activity, such as antivirus scans or indexing services. Furthermore, many systems have the 'noatime' option enabled, which stops the OS from updating this field entirely. Because of this noise and potential for total absence, relying on this value for evidence of user activity is inherently dangerous and prone to producing false positives.

Answer

It is only updated if the file is moved to a different folder

Answer

It is the most easily forged timestamp in the MFT

Answer

It only exists on FAT32 file systems

Question 6

Which of these is the primary limitation of using a file system 'Birth' time as a definitive event marker?

Accepted Answer

It is reset during file move or copy operations. The 'Birth' time is highly vulnerable to being reset or changed during common file operations, such as moving or copying files to a new location or restoring from a backup. Because it does not represent the original, immutable creation of the file in the environment, it cannot be reliably used as a 'ground truth' for when an attacker first introduced the file to the system. Investigators must corroborate this with other evidence.

Answer

It is not recorded in the MFT for small files

Answer

It is only available on newer versions of Windows

Answer

It is protected from being read by forensic tools

Question 7

An analyst is examining an NTFS volume and notices that a file's MFT entry shows a modification time earlier than its creation time. What is the most likely cause for this anomaly?

Accepted Answer

The file was moved from another volume or manipulated using timestomping techniques.. This anomaly is frequently caused by the 'timestomping' technique or a file move operation where the original metadata is preserved. By understanding file system internals, an analyst recognizes that MFT entry times are susceptible to manipulation via user-mode tools or low-level API calls. Detecting these inconsistencies is critical for identifying anti-forensics activity or specific file system behaviors that could lead to misinterpretation of the true timeline of events.

Answer

The file system is corrupted and requires an immediate CHKDSK operation.

Answer

The operating system experienced a clock drift during the file write process.

Answer

The master file table is using short filename (8.3) format which ignores creation time.

Question 8

When performing timeline analysis on a Linux system, which file is the most critical to examine to reconstruct user login and logout history?

Accepted Answer

/var/log/wtmp. The wtmp file is the standard repository for historical login and logout data on Linux systems. By tracking session durations and connection origins, investigators can establish a user's presence during the time of an incident. This file is essential for building a reliable user-activity timeline, which provides the context needed to link specific file system changes to a particular user account or remote connection.

Answer

/var/log/syslog

Answer

/var/run/utmp

Answer

/etc/passwd

Question 9

Which of the following describes the 'MAC' in MACB times during timeline analysis?

Accepted Answer

Modification, Access, Change, and Birth.. MACB refers to the four primary timestamps: Modification, Access, Change, and Birth (Creation). These are the fundamental metadata points recorded by file systems. Understanding these timestamps is the core of timeline forensics, as they allow analysts to reconstruct the sequence of events. Each timestamp provides a different perspective on how a file was interacted with, enabling the investigator to distinguish between reading, editing, and creating files on the disk.

Answer

Memory, Application, Cache, and Buffer.

Answer

Main, Auxiliary, Configuration, and Backup.

Answer

Master, Allocation, Cluster, and Bit-map.

Question 10

Why might an analyst prefer using 'Super-Timeline' creation tools, such as log2timeline, over manual collection of file system timestamps?

Accepted Answer

They provide a comprehensive view by integrating metadata from multiple sources.. Super-timelines aggregate data from diverse sources including file systems, event logs, registry hives, and application-specific artifacts into a single chronological view. Manual timestamp collection is limited to file system metadata, which often fails to capture the 'why' behind an event. By aggregating disparate data, analysts can correlate file changes with system events, providing a much richer, holistic context that is necessary to solve complex, multi-stage security incidents.

Answer

They automatically decrypt all files for easier analysis.

Answer

They eliminate the need to preserve original forensic images.

Answer

They ensure all files are permanently deleted from the disk.

Question 11

During a forensic investigation of a Windows 10 workstation, an analyst reviews the NTFS Master File Table (MFT) and notices that the $STANDARD_INFORMATION timestamps for a suspicious file are all dated 2023-08-15, but the $FILE_NAME timestamps are dated 2024-01-20. The file is located in C:\Users\Public\Downloads. Which of the following best explains this discrepancy?

Accepted Answer

The file was likely timestomped, as the $STANDARD_INFORMATION timestamps can be modified by user-mode tools while $FILE_NAME timestamps are harder to alter.. The correct answer is the option describing timestomping. In NTFS, $STANDARD_INFORMATION timestamps are easily modified by user-mode APIs, while $FILE_NAME timestamps are stored in the MFT and are more difficult to change. A large discrepancy where $STANDARD_INFORMATION times are earlier than $FILE_NAME times is a strong indicator of timestomping, often used by attackers to hide malicious files.

Answer

The file system journal ($LogFile) recorded a system time change, causing the $STANDARD_INFORMATION timestamps to be adjusted while the $FILE_NAME timestamps remained unchanged.

Answer

The file was copied from another NTFS volume, causing the $STANDARD_INFORMATION timestamps to reflect the original creation time while the $FILE_NAME timestamps reflect the copy time.

Answer

The file was restored from a backup, and the backup software restored the $STANDARD_INFORMATION timestamps but not the $FILE_NAME timestamps.

Question 12

An analyst acquires a forensic image of a Windows 10 NTFS volume using a write blocker and now needs to build a file system timeline. The analyst wants to include the $STANDARD_INFORMATION timestamps but also wants to detect timestomping by comparing them with the $FILE_NAME timestamps. Which tool should the analyst use to extract both timestamp sets from the MFT and generate a bodyfile for timeline creation?

Accepted Answer

MFTECmd. MFTECmd is specifically designed to parse the $MFT and output both $STANDARD_INFORMATION and $FILE_NAME timestamps, enabling direct comparison for timestomping detection. The other tools either do not extract both timestamp sets or are not intended for this purpose.

Answer

ntfs-3g

Answer

log2timeline.pl

Answer

fls from The Sleuth Kit

Question 13

A forensic analyst is examining a Linux ext4 file system and wants to determine when a file's metadata (such as permissions or ownership) was last changed. Which timestamp should they examine?

Accepted Answer

ctime. On Linux ext4, ctime is updated when file metadata changes, such as permissions or ownership. mtime reflects content changes, atime reflects access, and btime is creation time. Therefore, ctime is the correct timestamp to determine when metadata was last altered.

Answer

atime

Answer

btime

Answer

mtime

Question 14

An investigator is preparing to analyze a Windows 10 workstation's NTFS volume using a forensic tool that reads the master file table (MFT) directly. The goal is to build a timeline that includes timestamps for files that were deleted before the acquisition. Which artifact should the investigator primarily rely on to recover timestamps for deleted files?

Accepted Answer

The $MFT file and its unallocated MFT entry records. Unallocated MFT entries preserve the $STANDARD_INFORMATION and $FILE_NAME attributes of deleted files until those entries are reused. By parsing the $MFT, including slack and unallocated records, an analyst can recover the four MACB timestamps for files that no longer exist in the active file system, which is essential for a complete forensic timeline.

Answer

The $LogFile transaction log

Answer

The $UsnJrnl:$J change journal

Answer

The $Bitmap allocation file

Question 15

An investigator is analyzing a Windows 10 system and needs to correlate file system timestamps with other artifacts to build a comprehensive timeline. Which two of the following Windows artifacts can provide additional temporal context when combined with NTFS timestamps? (Choose two.)

Accepted Answer

Prefetch files. Windows Event Logs and Prefetch files provide independent temporal data that can be correlated with NTFS timestamps. Event logs record system and user activities, while prefetch shows application execution. Together, they enrich a timeline by providing context for file system changes, helping analysts understand the sequence of events.

Answer

$MFT

Answer

$LogFile

Answer

Registry hive files