GCFA Introduction to File System Timeline Forensics — Timed 20 Questions

Question 1

Which TWO file system artifacts or parameters are critical for an analyst to examine when evaluating the reliability of NTFS $STANDARD_INFORMATION and $FILE_NAME attribute timestamps during a timeline analysis? (Choose two)

20 minute time limit — choose an answer to begin.

Accepted Answer

Discrepancies between timestamps stored in the $STANDARD_INFORMATION attribute and the $FILE_NAME attribute. Examining macro-level attribute flags alongside distinct time zones and local offset variations helps determine whether timestamps were manipulated or naturally populated. In NTFS, the $STANDARD_INFORMATION attribute is easily modified by user-space tools, whereas the $FILE_NAME attribute updates are managed by the kernel, making discrepancies between the two a primary indicator of anti-forensic activity.

Answer

The presence of alternate data streams attached to the primary file path

Answer

The sector size configuration of the underlying RAID controller

Answer

The physical rotation speed and manufacturer cache size of the hard disk drive

Question 2

An analyst is reviewing a timeline generated from a compromised Windows workstation and notices a high volume of file accesses to various user documents immediately preceded by the creation of a prefetch file for a known archive utility. What forensic deduction can be made from this timeline sequence?

Accepted Answer

An attacker utilized an archiving utility to stage, bundle, or extract sensitive data for potential exfiltration.. The chronological correlation between the execution of an archive utility and subsequent mass file access events strongly suggests that compressed data was unpacked or searched on the system. Identifying this sequence helps investigators map out data staging and exfiltration preparation steps during incident response.

Answer

The user actively compressed and encrypted sensitive documents prior to an authorized data backup procedure.

Answer

The Windows Search Indexer service automatically parsed the archive contents to update the local database.

Answer

A scheduled antivirus scan initiated a signature analysis across all compressed archives stored in the user profile.

Question 3

Which TWO limitations or challenges should a forensic investigator keep in mind when relying on file system timelines to reconstruct user activity? (Choose two)

Accepted Answer

High-volume background operating system tasks can generate massive amounts of timeline noise, obscuring malicious events.. File system timelines are powerful tools, but they suffer from inherent blind spots such as timestamp anti-forensics and high-frequency noise that obscures malicious actions. Relying solely on timelines without correlating them against event logs or memory artifacts can lead to incomplete or inaccurate incident reconstruction.

Answer

File system timestamps are completely immune to modification by standard user-level administrator accounts.

Answer

Operating systems update file access times synchronously across all disk controllers without performance penalties.

Answer

Timelines automatically capture every memory-only injection attack and reflective DLL loading event executed on the system.

Answer

File creation timestamps are permanently deleted from disk immediately upon the termination of the parent process.

Question 4

An analyst is investigating an unauthorized file modification on an NTFS volume. Which set of timestamps provides the most reliable indicator of actual file content changes rather than metadata updates?

Accepted Answer

File Name attribute modification time. In NTFS, the Standard Information (SI) attribute timestamps are often modified by user-level tools, whereas File Name (FN) attribute timestamps are typically only updated by the OS kernel. Relying on SI attributes can lead to deception by anti-forensic tools that perform timestomping. Forensic analysts must compare both sets of attributes to identify discrepancies caused by manipulation, ensuring the integrity of the timeline analysis during incident response.

Answer

Standard Information attribute created time

Answer

Standard Information attribute modification time

Answer

System log event ID 4663

Question 5

Which TWO of the following accurately describe the limitations of using MACB (Modified, Accessed, Changed, Birth) timelines in forensic investigations?

Accepted Answer

Access times are frequently disabled by default in modern Windows and Linux distributions. MACB timelines rely on file system metadata, which can be inconsistent across different operating systems and file systems. Understanding these limitations is critical for a GCFA practitioner to prevent misinterpretation of findings. Specifically, access times are often disabled for performance reasons, and birth times are not universally supported, creating gaps in the chronological reconstruction that could lead to missing malicious activity during a comprehensive incident investigation.

Answer

The Change (C) time is synonymous with file content modification

Answer

MACB timelines are immune to anti-forensic manipulation

Answer

Modification time is automatically updated on every read operation

Question 6

Which artifact is most useful for verifying file access if the file system 'atime' is disabled?

Accepted Answer

Windows Prefetch files. When file system access times are disabled, investigators must look for alternative artifacts that record interactions with files. Prefetch files, shell items, and application logs are primary sources. Prefetch files specifically track when an application was executed, which often implies access to its associated configuration files and libraries, providing a secondary source of evidence that can substitute for the missing file-level access metadata in a timeline.

Answer

MFT $FILE_NAME attribute

Answer

Volume Shadow Copies

Answer

Registry Hive LastWrite time

Question 7

Which THREE of the following are valid reasons to include system event logs in a file system timeline?

Accepted Answer

Logs provide user context for file modifications. Integrating event logs provides the 'who' and 'why' that file system metadata lacks. File system timestamps only show that a file changed, but logs can correlate that change to a specific user login or a service start. Combining these sources allows for a comprehensive reconstruction of the attack lifecycle, moving from simple 'what happened' to a complete understanding of the intruder's intent and successful actions on the system.

Answer

Logs record the actual content of the file being written

Answer

Logs confirm the integrity of the file system's master clock

Question 8

Which action most effectively minimizes the risk of altering file system metadata during live forensic data collection?

Accepted Answer

Using kernel-mode forensic acquisition tools. Performing live data collection inherently touches files, potentially updating access times. Using tools that interact with the system at the lowest possible layer or utilizing trusted binaries from a mounted, read-only forensic drive reduces the impact on the system. However, the most effective method is to minimize interaction entirely or prioritize the use of kernel-level tools that bypass standard file system drivers to prevent the OS from updating metadata during the collection process.

Answer

Running scripts from the local system's hard drive

Answer

Enabling verbose logging during the collection process

Answer

Copying files to a network share via Windows Explorer

Question 9

Which THREE of the following represent common challenges when performing timeline analysis on a system with multiple time zones?

Accepted Answer

Inconsistent formatting of time zone offsets across different log sources. Managing time zones is a frequent source of error in multi-machine forensic investigations. When data sources are aggregated from systems in different regions or from cloud logs in UTC, failing to explicitly normalize all timestamps leads to false conclusions regarding causality. An analyst must carefully document the offset for each data source to create a single, valid master timeline that accurately represents the sequence of events as they truly unfolded.

Answer

File system timestamps are always stored in local time

Answer

The system clock automatically adjusts to the user's location

Question 10

Which TWO of the following actions typically result in the update of the $Standard_Information attribute in an NTFS file system?

Accepted Answer

Modifying the contents of a file.. The $Standard_Information attribute is the primary source for user-space file timestamps seen in Windows Explorer. Understanding which actions trigger updates to this attribute is vital for timeline construction. Since forensic tools rely heavily on these timestamps, an analyst must know precisely which operating system events affect this attribute versus those that only impact the $File_Name attribute, ensuring accuracy when determining the sequence of file access and modification.

Answer

Renaming a file within the same directory.

Answer

Copying a file to a new location on the same volume.

Answer

Viewing a file's properties window without opening the file.

Question 11

Refer to the exhibit. An analyst generated a timeline using the Sleuth Kit. What is the primary purpose of creating the bodyfile in this workflow?

Accepted Answer

To convert raw MFT records into a human-readable, time-sorted format.. The bodyfile serves as an intermediate, structured representation of the file system's state, containing metadata for every file. By standardizing this data, the analyst can use mactime to process large volumes of information efficiently. This separation of extraction from analysis is a standard forensic practice, ensuring that the raw file system data remains consistent while allowing for flexible filtering and temporal analysis during the investigation process.

Answer

To encrypt the file system metadata for secure storage.

Answer

To automatically execute a keyword search across all file contents.

Answer

To create a backup of the original disk image to prevent data loss.

Question 12

Which THREE of the following represent potential weaknesses when relying exclusively on system timestamps for forensic timelines?

Accepted Answer

Timestomping tools can modify MFT metadata.. Relying on system timestamps carries significant risks because they can be manipulated, inaccurate, or missing context. An analyst must be aware of these limitations to avoid drawing incorrect conclusions about a timeline. Understanding these weaknesses forces the investigator to corroborate findings with other artifacts like event logs, network traffic, or application-specific artifacts, ensuring a robust and defensible forensic conclusion that can withstand scrutiny.

Answer

The BIOS clock always synchronizes with NTP.

Answer

Metadata is automatically wiped when a file is opened.

Question 13

Refer to the exhibit. An investigator observes a discrepancy between the $Standard_Information and $File_Name timestamps in an NTFS MFT record. What is the most likely explanation for this difference?

Accepted Answer

The user manually edited the file metadata using a timestomping tool.. In NTFS, the $Standard_Information attribute is easily modified by user-mode applications, while the $File_Name attribute is typically only updated by the kernel during file system operations. A discrepancy where the $File_Name timestamp is later than the $Standard_Information timestamp often indicates that the file was modified or renamed in a way that bypassed standard APIs, a classic sign of anti-forensic activity like timestomping or moving a file across different volumes.

Answer

The file was corrupted during a recent system crash.

Answer

The file system driver is outdated and failing to sync attributes.

Answer

The file has been compressed by the Windows OS.

Question 14

An investigator is analyzing a compromised Linux server and needs to build a timeline of file system activity. The server uses ext4. The investigator runs the command 'debugfs -R "stat /etc/passwd" /dev/sda1' and observes the following timestamps: ctime: 2024-02-10 08:15:32, atime: 2024-02-11 09:20:45, mtime: 2024-02-10 08:15:32, crtime: 2024-01-05 10:00:00. The investigator also notes that the file's inode number is 12345. Which of the following is the most accurate interpretation of these timestamps for timeline reconstruction?

Accepted Answer

The file's content was last modified on 2024-02-10 08:15:32, and its metadata was last changed at the same time, which is consistent with a file write operation that updates both timestamps.. The correct interpretation is that mtime and ctime are equal, indicating a content write operation that updated both timestamps. In ext4, mtime records content modification, ctime records inode metadata changes, and a write updates both. The atime shows the last access, and crtime is the creation time. This pattern is common for file edits and is key for timeline analysis.

Answer

The file was last accessed on 2024-02-11 09:20:45, and its creation time is 2024-01-05 10:00:00, which is before the last metadata change, suggesting the file was created and then modified later.

Answer

The file's content was last modified on 2024-02-10 08:15:32, and its metadata was also last changed at that same time, indicating a single event that altered both.

Answer

The file's inode metadata was last changed on 2024-02-10 08:15:32, and its content was last modified at the same time, which could indicate a chmod or chown command that also updated mtime if the file was written to.

Question 15

An analyst is investigating a compromised Windows Server 2016 system. During timeline analysis, the analyst notices that several executable files in the C:\Windows\Temp directory have $STANDARD_INFORMATION modification times that are earlier than their $FILE_NAME modification times. What is the most likely explanation for this discrepancy?

Accepted Answer

The files were timestomped using a tool that modified the $STANDARD_INFORMATION timestamps.. A discrepancy where $STANDARD_INFORMATION modification time is earlier than $FILE_NAME modification time is a classic indicator of timestomping. Attackers often alter the $STANDARD_INFORMATION timestamps to make malicious files appear older, but the $FILE_NAME timestamps remain unchanged, creating this inconsistency.

Answer

The files were created by a process that set the $FILE_NAME timestamps to a future time.

Answer

The files were moved within the same volume, which updated the $STANDARD_INFORMATION timestamps but left the $FILE_NAME timestamps unchanged.

Answer

The files were copied from another volume, and the $FILE_NAME timestamps were updated during the copy process.

Question 16

A forensic analyst is examining a Windows 10 system and wants to build a comprehensive file system timeline. The analyst has already parsed the $MFT and USN journal. Which TWO additional artifacts should the analyst incorporate to most effectively correlate file system events with user and system activity? (Choose two.)

Accepted Answer

Windows Event Logs (e.g., Security.evtx, System.evtx). The correct choices are Windows Event Logs and Registry hives. Event logs provide records of user logons, process executions, and system events that can be correlated with file system changes. Registry hives store user and system settings, including evidence of file access and program execution. Together, they enrich a file system timeline with context about user and system activity, enabling more accurate reconstruction of events.

Answer

Prefetch files

Answer

$LogFile

Answer

$UsnJrnl:$J

Question 17

A forensic analyst is examining an NTFS volume and observes that a file's $STANDARD_INFORMATION modification timestamp is 2023-08-15 14:00:00, while its $FILE_NAME modification timestamp is 2023-08-10 09:30:00. The file is a spreadsheet that the user claims was last edited on August 10. Which of the following best explains this discrepancy?

Accepted Answer

The $STANDARD_INFORMATION timestamp was modified by a user-mode API call such as SetFileTime.. In NTFS, the $STANDARD_INFORMATION attribute timestamps can be altered by user-mode APIs, whereas the $FILE_NAME attribute timestamps are maintained by the file system and are not changed by such calls. A later $STANDARD_INFORMATION modification time compared to $FILE_NAME suggests the file's timestamp was modified after the last legitimate edit, potentially to obscure activity.

Answer

The $STANDARD_INFORMATION timestamp is updated only when the file content changes, while $FILE_NAME is updated on metadata changes.

Answer

The $FILE_NAME timestamp reflects the time the file was last backed up.

Answer

The $FILE_NAME timestamp was updated by a file system tunneling operation.

Question 18

An analyst is examining an NTFS volume and finds that the $MFT record for a file shows a $STANDARD_INFORMATION modification time of 2024-03-10 08:00:00, but the $FILE_NAME modification time is 2024-03-09 22:00:00. The file's content is known to have been modified only once. Which of the following best explains this discrepancy?

Accepted Answer

The $STANDARD_INFORMATION modification time was altered by a user-mode API or tool, while the $FILE_NAME modification time reflects the original content modification.. The $STANDARD_INFORMATION timestamps are easily modified by user-mode APIs, while $FILE_NAME timestamps are updated by the file system during filename operations. A later $STANDARD_INFORMATION modification time with an earlier $FILE_NAME modification time suggests the former was tampered with. The $FILE_NAME timestamp is more likely to reflect the original content modification.

Answer

The system clock was adjusted backward after the file modification, causing the $FILE_NAME timestamp to be earlier.

Answer

The file was copied from another volume, and the $FILE_NAME timestamp retained the original creation time.

Answer

The file was renamed, which updated the $FILE_NAME modification time, but the content modification updated only the $STANDARD_INFORMATION modification time.

Question 19

An investigator is analyzing a Windows system and finds that a suspicious file has an NTFS $STANDARD_INFORMATION creation time of 2023-05-01 09:00:00, but the $FILE_NAME creation time is 2023-05-01 08:55:00. The file's $LogFile entries show that the file was created at 2023-05-01 08:50:00. Which timestamp is most likely the true creation time of the file?

Accepted Answer

The $LogFile creation time. The $LogFile records low-level file system transactions and is less prone to tampering than $STANDARD_INFORMATION or $FILE_NAME timestamps. Since it shows the earliest creation time and is consistent with a transactional record, it is the most reliable source for the true creation time.

Answer

The $FILE_NAME creation time

Answer

The average of the three timestamps

Answer

The $STANDARD_INFORMATION creation time

Question 20

An analyst is examining a timeline from a Windows 10 system and notices that a file's $FN creation timestamp is significantly earlier than its $SI creation timestamp. The file is located in a directory that was recently moved from another volume. What is the most likely explanation for this discrepancy?

Accepted Answer

The directory was moved across volumes, causing the $SI timestamps to be updated to the move time while the $FN timestamps retained the original creation time from the source volume.. In NTFS, when a file is moved across volumes, Windows treats it as a copy and delete operation. The new file on the destination volume receives new $STANDARD_INFORMATION timestamps (creation, modified, etc.) set to the time of the move. However, the $FILE_NAME timestamps are copied from the original file's $FN attribute, preserving the original creation time. This leads to a situation where the $FN creation time is earlier than the $SI creation time. This is a common forensic artifact indicating a cross-volume move, and analysts should recognize it to avoid misinterpretation.

Answer

The file was created on the source volume, then the system clock was rolled back before the move, causing the $SI timestamps to be later than the $FN timestamps.

Answer

The file's $SI timestamps were modified by a timestamping tool after the file was moved, while the $FN timestamps remained unchanged.

Answer

The file was copied using a tool that preserves $FN timestamps but updates $SI timestamps to the copy time.