GCFA NTFS Artifact Analysis — 30 Questions

Question 1

Which TWO of the following MFT attributes are most relevant for detecting timestomping activity?

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME. The $STANDARD_INFORMATION and $FILE_NAME attributes are the two primary locations where NTFS stores timestamps. Malware often modifies the $STANDARD_INFORMATION attribute to deceive forensic tools, but it frequently fails to update the $FILE_NAME attribute because the operating system manages it differently. Comparing these two sets of timestamps allows an analyst to identify discrepancies that indicate malicious manipulation of file metadata during an incident response investigation.

Answer

$DATA and $BITMAP

Answer

$ATTRIBUTE_LIST and $EA

Answer

$STANDARD_INFORMATION and $DATA

Answer

$FILE_NAME and $VOLUME_INFORMATION

Question 2

Which THREE of the following are valid components of an NTFS MFT record?

Accepted Answer

Record Header. Every NTFS MFT record consists of a header, an attribute list, and the attributes themselves. The header contains metadata about the record, while the attributes (like $STANDARD_INFORMATION, $FILE_NAME, and $DATA) hold the actual file information. Mastering these structural components is essential for manual MFT parsing, which is often required when forensic tools fail to interpret corrupted entries or hidden data streams.

Answer

Cluster Bitmap

Answer

Volume Boot Record

Question 3

Which NTFS attribute would an investigator examine to recover a deleted file's original name if the $MFT entry was partially overwritten?

Accepted Answer

$FILE_NAME. The $FILE_NAME attribute is stored in the MFT record and is often preserved even when a file is deleted. Since the operating system manages this attribute strictly, it is a highly reliable source for identifying files, especially when the $STANDARD_INFORMATION attribute has been modified. Even if the primary record is damaged, checking for multiple $FILE_NAME entries or parsing the MFT can often yield the original file name.

Answer

$DATA

Answer

$INDEX_ROOT

Answer

$VOLUME_NAME

Question 4

Which THREE items are included in the $STANDARD_INFORMATION attribute?

Accepted Answer

Creation Time. The $STANDARD_INFORMATION attribute is the primary source for the MACE timestamps that forensic analysts rely on for timeline reconstruction. It also contains the file's security ID and attributes like 'read-only' or 'hidden'. While these timestamps are easily modified by user-level tools, they remain a critical starting point for any forensic timeline, providing the baseline for comparison against the more robust $FILE_NAME attribute timestamps.

Answer

Data Run Offsets

Answer

Directory Index Key

Question 5

An analyst is investigating a suspicious file and identifies that the filename is stored in the $FILE_NAME attribute but not in the $DATA attribute. What does this indicate regarding the file's state?

Accepted Answer

The file has been deleted from the filesystem.. In NTFS, the $FILE_NAME attribute is managed by the kernel and remains static, while the $DATA attribute represents the actual file content. When a file is deleted, the entry in the Master File Table (MFT) is marked as free, and the $DATA attribute is often zeroed or deallocated. Identifying a mismatch or missing data indicates the file was likely deleted, emphasizing the importance of MFT analysis for recovery.

Answer

The file is encrypted using BitLocker.

Answer

The file is a compressed sparse file.

Answer

The file is a hard link to another file.

Question 6

Which TWO of the following attributes in an NTFS MFT record are most critical for establishing the 'MACB' timeline of a file?

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME. The $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes both contain timestamps. $SI is what standard Windows APIs report to the user, while $FN is updated only by the system kernel during specific file operations. Comparing these two enables detection of 'timestomping' attacks where a user modifies $SI times to hide malicious activity, making them essential for high-fidelity forensic analysis.

Answer

$DATA and $ATTRIBUTE_LIST

Answer

$STANDARD_INFORMATION and $DATA

Answer

$FILE_NAME and $INDEX_ROOT

Answer

$LOGGED_UTILITY_STREAM and $STANDARD_INFORMATION

Question 7

Based on the provided MFT exhibit, what forensic conclusion can be drawn regarding this file?

Accepted Answer

The file timestamps have been manipulated (timestomped).. The $SI (Standard Information) timestamp is earlier than the $FN (File Name) timestamp. Since $SI is user-mode modifiable and $FN is kernel-controlled, this discrepancy suggests that the file timestamps were likely modified by an anti-forensic tool (timestomping). $FN represents the 'true' system time, and the difference proves the $SI metadata does not reflect the actual file modification history.

Answer

The file system is corrupted and requires chkdsk.

Answer

The file was recently moved to a new volume.

Answer

The file was created using a non-Windows utility.

Question 8

Which THREE of the following are valid NTFS system files that reside in the Master File Table?

Accepted Answer

$MFT. NTFS uses the first 16 MFT records to store core system files that manage the volume. These include $MFT (the master file table), $LogFile (for transaction logging), $Volume (volume metadata), $Bitmap (space management), and $Root (root directory). Identifying these is critical because they provide the framework for understanding how data is organized, tracked, and protected against power failures or system crashes on the volume.

Answer

$UserActivity

Answer

$Registry

Question 9

Which THREE items are included in the $STANDARD_INFORMATION ($SI) attribute of an MFT record?

Accepted Answer

File Modification Timestamp. $SI is the primary attribute for file timestamps (Modified, Accessed, Created, and Birth/MFT Change). It also includes flags like Read-Only, Hidden, and System. Because it is easily modified by user-space, it is the primary target for timestomping. Analysts must contrast these with the $FILE_NAME attributes to identify inconsistencies that suggest malicious activity or evidence tampering by an intruder.

Answer

Data Run Offsets

Answer

Parent Directory ID

Question 10

Based on the MFT exhibit provided, what is the status of this file?

Accepted Answer

The file has been deleted from the disk.. A flag of 0x00 indicates the MFT record is marked as 'free' (deleted). The absence of the $DATA attribute confirms that the file has been unlinked from the filesystem. This is a common scenario in forensic investigations where an analyst is looking for evidence of file deletion; the MFT entry persists until the system overwrites it with new data.

Answer

The file is an active, read-only system file.

Answer

The file is currently being accessed by a process.

Answer

The file is a directory that is empty.

Question 11

A compromised Windows 10 workstation was imaged after an intruder deleted several files. You are examining the NTFS $MFT for evidence of file deletion. Which two MFT record header fields indicate that an MFT entry is no longer in use and was previously allocated to a file? (Choose two.)

Accepted Answer

The Flags field in the MFT record header has the in-use bit cleared (0x00).. The MFT record header contains the Flags field, which includes an in-use bit, and the Sequence Number, which is incremented when the record is freed. Together, these fields allow an analyst to determine that an MFT entry is no longer allocated and was previously used. Other attributes like timestamps or $DATA residency do not directly indicate deletion status.

Answer

The $FILE_NAME attribute contains a namespace value of 2 (Win32 & DOS).

Answer

The record's $DATA attribute is non-resident and its allocated size is zero.

Answer

The $STANDARD_INFORMATION attribute's MFT change time ($MFT Modified) is later than the $FILE_NAME attribute's creation timestamp.

Question 12

You are examining a Windows 10 workstation and find that a user's Documents folder contains a file named 'budget.xlsx' with an MFT entry that has a $STANDARD_INFORMATION attribute with creation time 2023-08-10 09:15:00 and a $FILE_NAME attribute with creation time 2023-07-01 14:20:00. The $STANDARD_INFORMATION timestamps are all within a few seconds of each other, while the $FILE_NAME timestamps are from a month earlier. What is the most likely explanation for this discrepancy?

Accepted Answer

The file was created on 2023-07-01, and its $STANDARD_INFORMATION timestamps were later modified by a timestomping tool.. The $FILE_NAME attribute timestamps are only updated by the file system during creation, renaming, or moving, and cannot be directly modified by user-mode tools. In contrast, $STANDARD_INFORMATION timestamps can be set by APIs like SetFileTime. When $STANDARD_INFORMATION timestamps are newer and uniform, it indicates timestomping to make the file appear created later than it actually was.

Answer

The file was created on 2023-08-10, and the $FILE_NAME timestamps were not updated due to a file system bug.

Answer

The file was copied from an external drive on 2023-08-10, preserving the original $FILE_NAME timestamps from the source.

Answer

The file was created on 2023-07-01, and the $STANDARD_INFORMATION timestamps were updated on 2023-08-10 by a legitimate application that modifies file metadata.

Question 13

A forensic analyst is examining an NTFS volume and discovers that several MFT entries contain a $FILE_NAME attribute with a namespace value of 2 (POSIX). The analyst also notes that the corresponding $STANDARD_INFORMATION attribute shows a creation timestamp that is later than the modification timestamp. What is the most likely explanation for this discrepancy?

Accepted Answer

The file's $STANDARD_INFORMATION timestamps were likely manipulated, as the creation time being later than the modification time is a common indicator of timestomping.. A creation timestamp that is later than the modification timestamp in $STANDARD_INFORMATION is a classic anomaly indicating timestomping. Legitimate file operations rarely produce this pattern. The $FILE_NAME attribute often retains original timestamps, providing a basis for comparison. Thus, the most likely explanation is deliberate manipulation of the $STANDARD_INFORMATION timestamps.

Answer

The file was moved from a different volume, and NTFS preserved the original $FILE_NAME timestamps while updating $STANDARD_INFORMATION on the new volume.

Answer

The file was created on a POSIX-compliant system, which does not update the $STANDARD_INFORMATION timestamps correctly.

Answer

The file's timestamps were modified using a tool that only updates the $FILE_NAME timestamps, leaving the $STANDARD_INFORMATION timestamps inconsistent.

Question 14

During an investigation of a compromised Windows server, an analyst finds that a suspicious executable's $STANDARD_INFORMATION timestamps show a creation time earlier than the volume's format date, while the $FILE_NAME timestamps appear consistent with recent activity. The analyst wants to determine whether the timestamps were manipulated using a known timestomping technique. Which NTFS artifact provides the most reliable evidence of timestomping in this scenario?

Accepted Answer

The $FILE_NAME attribute's creation timestamp, because it cannot be modified by user-mode APIs. The $FILE_NAME attribute timestamps are updated by the file system when a file is created, renamed, or moved, and they are not directly writable through common user-mode APIs used by timestomping tools. When they conflict with $STANDARD_INFORMATION timestamps that show an impossible creation date, the discrepancy is strong evidence of manipulation.

Answer

The $DATA attribute's allocated size, because timestomping changes the file's logical size

Answer

The $SECURITY_DESCRIPTOR attribute, because timestomping requires privilege escalation

Answer

The $LOGGED_UTILITY_STREAM attribute, because it records all timestamp modifications

Question 15

During a forensic examination of an NTFS volume, an analyst observes that a file's $STANDARD_INFORMATION timestamps show a Modified time of 2024-03-10 14:22:00, while the $FILE_NAME timestamps show a Modified time of 2024-03-08 09:15:00. The file is not a system file and has no apparent reason for the discrepancy. What is the most likely explanation for this difference?

Accepted Answer

The $STANDARD_INFORMATION timestamps were updated by a subsequent file modification, while the $FILE_NAME timestamps reflect the time of the last rename or move.. The $STANDARD_INFORMATION attribute timestamps are updated when file content changes, whereas $FILE_NAME timestamps are updated when the file is renamed or moved. A later Modified time in $STANDARD_INFORMATION than in $FILE_NAME indicates the file was modified after its last rename or move. This is a normal NTFS behavior and not necessarily indicative of malicious activity, making it the most plausible explanation for the discrepancy.

Answer

The file was copied from another NTFS volume, and the $FILE_NAME timestamps reflect the original creation time.

Answer

The file was renamed, causing the $FILE_NAME timestamps to be updated while $STANDARD_INFORMATION remained unchanged.

Answer

The $FILE_NAME timestamps were updated by a timestomping tool that only modified $STANDARD_INFORMATION.

Question 16

An analyst is examining a Windows system and finds that a file named 'confidential.docx' has an MFT entry with a $STANDARD_INFORMATION attribute that includes a security ID. The analyst wants to determine which user account last accessed the file. Which NTFS artifact should the analyst examine to map the security ID to a user account?

Accepted Answer

The $Secure metadata file, which contains the security descriptors and a mapping of security IDs to security descriptors.. The $STANDARD_INFORMATION attribute contains a security ID that indexes into the $Secure metadata file. $Secure stores unique security descriptors and provides indexes ($SII and $SDH) to look up the descriptor by security ID. The descriptor contains the owner SID, which can be resolved to a user account via the SAM or Active Directory.

Answer

The $MFT metadata file, which contains the security ID directly mapped to a username.

Answer

The $UsnJrnl metadata file, which records security ID changes for each file.

Answer

The $LogFile metadata file, which logs security descriptor changes and can be replayed to find the user.

Question 17

During an investigation of a compromised Windows server, an analyst extracts an MFT record and observes that the $DATA attribute is non-resident and the $ATTRIBUTE_LIST attribute is present. The analyst also notes that the MFT record contains a $BITMAP attribute. Which statement best describes the forensic implication of these attributes appearing together in a single MFT entry?

Accepted Answer

The MFT entry is an extension record that contains overflow attributes for a base record whose attributes could not fit in a single MFT entry.. In NTFS, a file with many attributes or large resident attributes uses $ATTRIBUTE_LIST to point to extension MFT records. These extension records can contain a $BITMAP attribute that tracks which records in the extension set are in use. The simultaneous presence of $ATTRIBUTE_LIST, non-resident $DATA, and $BITMAP in one MFT entry indicates that the entry is an extension record rather than a simple base record for a directory, sparse file, or compressed file.

Answer

The MFT entry is a base record for a directory, and the $BITMAP attribute tracks which index entries are in use within the directory's $INDEX_ALLOCATION.

Answer

The MFT entry is a base record for a compressed file, and the $BITMAP attribute tracks which compression units have been successfully compressed.

Answer

The MFT entry is a base record for a sparse file, and the $BITMAP attribute tracks which clusters within the file are allocated versus sparse.

Question 18

A forensic analyst is examining an NTFS volume and wants to determine the original path of a file that has been moved to a different directory on the same volume. Which artifact provides the most reliable information about the file's original location?

Accepted Answer

The $FILE_NAME attribute of the MFT entry, which stores the parent directory reference and the filename.. The $FILE_NAME attribute in the MFT entry contains the filename and a parent directory reference. When a file is moved within the same volume, this attribute is updated to reflect the new parent. However, if the file had multiple hard links or was renamed, multiple $FILE_NAME attributes may exist, preserving historical names and parent references. Thus, it is the most reliable artifact for determining original location, though it may require careful interpretation.

Answer

The $OBJECT_ID attribute, which stores a unique identifier that can be linked to the file's original path via the $ObjId index.

Answer

The $STANDARD_INFORMATION attribute, which records the file's creation, modification, and access timestamps.

Answer

The $INDEX_ROOT attribute, which contains the directory index for the file's current parent directory.

Question 19

During an investigation, an analyst discovers that a file's $STANDARD_INFORMATION attribute has a timestamp with a value that is not a valid NTFS timestamp (e.g., year 1601). What is the most likely cause of this anomaly?

Accepted Answer

The file's timestamp was manually set using a tool that allows arbitrary values, a technique known as timestomping.. An NTFS timestamp of year 1601 is the zero value of the FILETIME structure, which is not a valid time for a real file. This anomaly is typically caused by timestomping tools that allow setting arbitrary timestamps, or by deliberate corruption. It is a red flag for anti-forensic activity, and analysts should compare with $FILE_NAME timestamps to corroborate.

Answer

The file was created on a FAT file system and later converted to NTFS, which preserved the invalid timestamp.

Answer

The file was accessed by a legacy application that does not support modern timestamps, causing NTFS to revert to the epoch.

Answer

The file is a system file, and NTFS uses a special timestamp format for system files that can include year 1601.

Question 20

An investigator is analyzing a Windows system and notices that a file's $STANDARD_INFORMATION timestamps show a creation date of 2020, while the $FILE_NAME timestamps show a creation date of 2023. The file's content appears to be from 2023. The investigator suspects timestomping. Which NTFS artifact should be examined to corroborate the true creation time by looking at when the file's MFT record was last modified?

Accepted Answer

The $LogFile transaction records for the MFT record. The $LogFile is a transactional log that records metadata changes to NTFS structures, including MFT record updates. If timestomping altered $STANDARD_INFORMATION timestamps, the $LogFile may still contain records showing when the MFT record was actually modified. This can corroborate the true creation time. The other options are either part of the manipulable $STANDARD_INFORMATION or do not directly record MFT record modification.

Answer

The $MFT record's $STANDARD_INFORMATION attribute change time

Answer

The $MFT record's $STANDARD_INFORMATION MFT entry modified time

Answer

The $FILE_NAME attribute's creation timestamp