GCFA Introduction to File System Timeline Forensics — Timed 15 Questions

Question 1

Which TWO file system artifacts or parameters are critical for an analyst to examine when evaluating the reliability of NTFS $STANDARD_INFORMATION and $FILE_NAME attribute timestamps during a timeline analysis? (Choose two)

15 minute time limit — choose an answer to begin.

Accepted Answer

Discrepancies between timestamps stored in the $STANDARD_INFORMATION attribute and the $FILE_NAME attribute. Examining macro-level attribute flags alongside distinct time zones and local offset variations helps determine whether timestamps were manipulated or naturally populated. In NTFS, the $STANDARD_INFORMATION attribute is easily modified by user-space tools, whereas the $FILE_NAME attribute updates are managed by the kernel, making discrepancies between the two a primary indicator of anti-forensic activity.

Answer

The presence of alternate data streams attached to the primary file path

Answer

The sector size configuration of the underlying RAID controller

Answer

The physical rotation speed and manufacturer cache size of the hard disk drive

Question 2

An analyst is reviewing a timeline generated from a compromised Windows workstation and notices a high volume of file accesses to various user documents immediately preceded by the creation of a prefetch file for a known archive utility. What forensic deduction can be made from this timeline sequence?

Accepted Answer

An attacker utilized an archiving utility to stage, bundle, or extract sensitive data for potential exfiltration.. The chronological correlation between the execution of an archive utility and subsequent mass file access events strongly suggests that compressed data was unpacked or searched on the system. Identifying this sequence helps investigators map out data staging and exfiltration preparation steps during incident response.

Answer

The user actively compressed and encrypted sensitive documents prior to an authorized data backup procedure.

Answer

The Windows Search Indexer service automatically parsed the archive contents to update the local database.

Answer

A scheduled antivirus scan initiated a signature analysis across all compressed archives stored in the user profile.

Question 3

Which TWO limitations or challenges should a forensic investigator keep in mind when relying on file system timelines to reconstruct user activity? (Choose two)

Accepted Answer

High-volume background operating system tasks can generate massive amounts of timeline noise, obscuring malicious events.. File system timelines are powerful tools, but they suffer from inherent blind spots such as timestamp anti-forensics and high-frequency noise that obscures malicious actions. Relying solely on timelines without correlating them against event logs or memory artifacts can lead to incomplete or inaccurate incident reconstruction.

Answer

File system timestamps are completely immune to modification by standard user-level administrator accounts.

Answer

Operating systems update file access times synchronously across all disk controllers without performance penalties.

Answer

Timelines automatically capture every memory-only injection attack and reflective DLL loading event executed on the system.

Answer

File creation timestamps are permanently deleted from disk immediately upon the termination of the parent process.

Question 4

An analyst is investigating an unauthorized file modification on an NTFS volume. Which set of timestamps provides the most reliable indicator of actual file content changes rather than metadata updates?

Accepted Answer

File Name attribute modification time. In NTFS, the Standard Information (SI) attribute timestamps are often modified by user-level tools, whereas File Name (FN) attribute timestamps are typically only updated by the OS kernel. Relying on SI attributes can lead to deception by anti-forensic tools that perform timestomping. Forensic analysts must compare both sets of attributes to identify discrepancies caused by manipulation, ensuring the integrity of the timeline analysis during incident response.

Answer

Standard Information attribute created time

Answer

Standard Information attribute modification time

Answer

System log event ID 4663

Question 5

Which TWO of the following accurately describe the limitations of using MACB (Modified, Accessed, Changed, Birth) timelines in forensic investigations?

Accepted Answer

Access times are frequently disabled by default in modern Windows and Linux distributions. MACB timelines rely on file system metadata, which can be inconsistent across different operating systems and file systems. Understanding these limitations is critical for a GCFA practitioner to prevent misinterpretation of findings. Specifically, access times are often disabled for performance reasons, and birth times are not universally supported, creating gaps in the chronological reconstruction that could lead to missing malicious activity during a comprehensive incident investigation.

Answer

The Change (C) time is synonymous with file content modification

Answer

MACB timelines are immune to anti-forensic manipulation

Answer

Modification time is automatically updated on every read operation

Question 6

Which artifact is most useful for verifying file access if the file system 'atime' is disabled?

Accepted Answer

Windows Prefetch files. When file system access times are disabled, investigators must look for alternative artifacts that record interactions with files. Prefetch files, shell items, and application logs are primary sources. Prefetch files specifically track when an application was executed, which often implies access to its associated configuration files and libraries, providing a secondary source of evidence that can substitute for the missing file-level access metadata in a timeline.

Answer

MFT $FILE_NAME attribute

Answer

Volume Shadow Copies

Answer

Registry Hive LastWrite time

Question 7

Which THREE of the following are valid reasons to include system event logs in a file system timeline?

Accepted Answer

Logs provide user context for file modifications. Integrating event logs provides the 'who' and 'why' that file system metadata lacks. File system timestamps only show that a file changed, but logs can correlate that change to a specific user login or a service start. Combining these sources allows for a comprehensive reconstruction of the attack lifecycle, moving from simple 'what happened' to a complete understanding of the intruder's intent and successful actions on the system.

Answer

Logs record the actual content of the file being written

Answer

Logs confirm the integrity of the file system's master clock

Question 8

Which action most effectively minimizes the risk of altering file system metadata during live forensic data collection?

Accepted Answer

Using kernel-mode forensic acquisition tools. Performing live data collection inherently touches files, potentially updating access times. Using tools that interact with the system at the lowest possible layer or utilizing trusted binaries from a mounted, read-only forensic drive reduces the impact on the system. However, the most effective method is to minimize interaction entirely or prioritize the use of kernel-level tools that bypass standard file system drivers to prevent the OS from updating metadata during the collection process.

Answer

Running scripts from the local system's hard drive

Answer

Enabling verbose logging during the collection process

Answer

Copying files to a network share via Windows Explorer

Question 9

Which THREE of the following represent common challenges when performing timeline analysis on a system with multiple time zones?

Accepted Answer

Inconsistent formatting of time zone offsets across different log sources. Managing time zones is a frequent source of error in multi-machine forensic investigations. When data sources are aggregated from systems in different regions or from cloud logs in UTC, failing to explicitly normalize all timestamps leads to false conclusions regarding causality. An analyst must carefully document the offset for each data source to create a single, valid master timeline that accurately represents the sequence of events as they truly unfolded.

Answer

File system timestamps are always stored in local time

Answer

The system clock automatically adjusts to the user's location

Question 10

Which TWO of the following actions typically result in the update of the $Standard_Information attribute in an NTFS file system?

Accepted Answer

Modifying the contents of a file.. The $Standard_Information attribute is the primary source for user-space file timestamps seen in Windows Explorer. Understanding which actions trigger updates to this attribute is vital for timeline construction. Since forensic tools rely heavily on these timestamps, an analyst must know precisely which operating system events affect this attribute versus those that only impact the $File_Name attribute, ensuring accuracy when determining the sequence of file access and modification.

Answer

Renaming a file within the same directory.

Answer

Copying a file to a new location on the same volume.

Answer

Viewing a file's properties window without opening the file.

Question 11

Refer to the exhibit. An analyst generated a timeline using the Sleuth Kit. What is the primary purpose of creating the bodyfile in this workflow?

Accepted Answer

To convert raw MFT records into a human-readable, time-sorted format.. The bodyfile serves as an intermediate, structured representation of the file system's state, containing metadata for every file. By standardizing this data, the analyst can use mactime to process large volumes of information efficiently. This separation of extraction from analysis is a standard forensic practice, ensuring that the raw file system data remains consistent while allowing for flexible filtering and temporal analysis during the investigation process.

Answer

To encrypt the file system metadata for secure storage.

Answer

To automatically execute a keyword search across all file contents.

Answer

To create a backup of the original disk image to prevent data loss.

Question 12

Which THREE of the following represent potential weaknesses when relying exclusively on system timestamps for forensic timelines?

Accepted Answer

Timestomping tools can modify MFT metadata.. Relying on system timestamps carries significant risks because they can be manipulated, inaccurate, or missing context. An analyst must be aware of these limitations to avoid drawing incorrect conclusions about a timeline. Understanding these weaknesses forces the investigator to corroborate findings with other artifacts like event logs, network traffic, or application-specific artifacts, ensuring a robust and defensible forensic conclusion that can withstand scrutiny.

Answer

The BIOS clock always synchronizes with NTP.

Answer

Metadata is automatically wiped when a file is opened.

Question 13

Refer to the exhibit. An investigator observes a discrepancy between the $Standard_Information and $File_Name timestamps in an NTFS MFT record. What is the most likely explanation for this difference?

Accepted Answer

The user manually edited the file metadata using a timestomping tool.. In NTFS, the $Standard_Information attribute is easily modified by user-mode applications, while the $File_Name attribute is typically only updated by the kernel during file system operations. A discrepancy where the $File_Name timestamp is later than the $Standard_Information timestamp often indicates that the file was modified or renamed in a way that bypassed standard APIs, a classic sign of anti-forensic activity like timestomping or moving a file across different volumes.

Answer

The file was corrupted during a recent system crash.

Answer

The file system driver is outdated and failing to sync attributes.

Answer

The file has been compressed by the Windows OS.

Question 14

An investigator is analyzing a compromised Linux server and needs to build a timeline of file system activity. The server uses ext4. The investigator runs the command 'debugfs -R "stat /etc/passwd" /dev/sda1' and observes the following timestamps: ctime: 2024-02-10 08:15:32, atime: 2024-02-11 09:20:45, mtime: 2024-02-10 08:15:32, crtime: 2024-01-05 10:00:00. The investigator also notes that the file's inode number is 12345. Which of the following is the most accurate interpretation of these timestamps for timeline reconstruction?

Accepted Answer

The file's content was last modified on 2024-02-10 08:15:32, and its metadata was last changed at the same time, which is consistent with a file write operation that updates both timestamps.. The correct interpretation is that mtime and ctime are equal, indicating a content write operation that updated both timestamps. In ext4, mtime records content modification, ctime records inode metadata changes, and a write updates both. The atime shows the last access, and crtime is the creation time. This pattern is common for file edits and is key for timeline analysis.

Answer

The file was last accessed on 2024-02-11 09:20:45, and its creation time is 2024-01-05 10:00:00, which is before the last metadata change, suggesting the file was created and then modified later.

Answer

The file's content was last modified on 2024-02-10 08:15:32, and its metadata was also last changed at that same time, indicating a single event that altered both.

Answer

The file's inode metadata was last changed on 2024-02-10 08:15:32, and its content was last modified at the same time, which could indicate a chmod or chown command that also updated mtime if the file was written to.

Question 15

An analyst is investigating a compromised Windows Server 2016 system. During timeline analysis, the analyst notices that several executable files in the C:\Windows\Temp directory have $STANDARD_INFORMATION modification times that are earlier than their $FILE_NAME modification times. What is the most likely explanation for this discrepancy?

Accepted Answer

The files were timestomped using a tool that modified the $STANDARD_INFORMATION timestamps.. A discrepancy where $STANDARD_INFORMATION modification time is earlier than $FILE_NAME modification time is a classic indicator of timestomping. Attackers often alter the $STANDARD_INFORMATION timestamps to make malicious files appear older, but the $FILE_NAME timestamps remain unchanged, creating this inconsistency.

Answer

The files were created by a process that set the $FILE_NAME timestamps to a future time.

Answer

The files were moved within the same volume, which updated the $STANDARD_INFORMATION timestamps but left the $FILE_NAME timestamps unchanged.

Answer

The files were copied from another volume, and the $FILE_NAME timestamps were updated during the copy process.