GCFA NTFS Artifact Analysis — Timed 15 Questions

Question 1

Which TWO of the following MFT attributes are most relevant for detecting timestomping activity?

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME. The $STANDARD_INFORMATION and $FILE_NAME attributes are the two primary locations where NTFS stores timestamps. Malware often modifies the $STANDARD_INFORMATION attribute to deceive forensic tools, but it frequently fails to update the $FILE_NAME attribute because the operating system manages it differently. Comparing these two sets of timestamps allows an analyst to identify discrepancies that indicate malicious manipulation of file metadata during an incident response investigation.

Answer

$DATA and $BITMAP

Answer

$ATTRIBUTE_LIST and $EA

Answer

$STANDARD_INFORMATION and $DATA

Answer

$FILE_NAME and $VOLUME_INFORMATION

Question 2

Which THREE of the following are valid components of an NTFS MFT record?

Accepted Answer

Record Header. Every NTFS MFT record consists of a header, an attribute list, and the attributes themselves. The header contains metadata about the record, while the attributes (like $STANDARD_INFORMATION, $FILE_NAME, and $DATA) hold the actual file information. Mastering these structural components is essential for manual MFT parsing, which is often required when forensic tools fail to interpret corrupted entries or hidden data streams.

Answer

Cluster Bitmap

Answer

Volume Boot Record

Question 3

Which NTFS attribute would an investigator examine to recover a deleted file's original name if the $MFT entry was partially overwritten?

Accepted Answer

$FILE_NAME. The $FILE_NAME attribute is stored in the MFT record and is often preserved even when a file is deleted. Since the operating system manages this attribute strictly, it is a highly reliable source for identifying files, especially when the $STANDARD_INFORMATION attribute has been modified. Even if the primary record is damaged, checking for multiple $FILE_NAME entries or parsing the MFT can often yield the original file name.

Answer

$DATA

Answer

$INDEX_ROOT

Answer

$VOLUME_NAME

Question 4

Which THREE items are included in the $STANDARD_INFORMATION attribute?

Accepted Answer

Creation Time. The $STANDARD_INFORMATION attribute is the primary source for the MACE timestamps that forensic analysts rely on for timeline reconstruction. It also contains the file's security ID and attributes like 'read-only' or 'hidden'. While these timestamps are easily modified by user-level tools, they remain a critical starting point for any forensic timeline, providing the baseline for comparison against the more robust $FILE_NAME attribute timestamps.

Answer

Data Run Offsets

Answer

Directory Index Key

Question 5

An analyst is investigating a suspicious file and identifies that the filename is stored in the $FILE_NAME attribute but not in the $DATA attribute. What does this indicate regarding the file's state?

Accepted Answer

The file has been deleted from the filesystem.. In NTFS, the $FILE_NAME attribute is managed by the kernel and remains static, while the $DATA attribute represents the actual file content. When a file is deleted, the entry in the Master File Table (MFT) is marked as free, and the $DATA attribute is often zeroed or deallocated. Identifying a mismatch or missing data indicates the file was likely deleted, emphasizing the importance of MFT analysis for recovery.

Answer

The file is encrypted using BitLocker.

Answer

The file is a compressed sparse file.

Answer

The file is a hard link to another file.

Question 6

Which TWO of the following attributes in an NTFS MFT record are most critical for establishing the 'MACB' timeline of a file?

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME. The $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes both contain timestamps. $SI is what standard Windows APIs report to the user, while $FN is updated only by the system kernel during specific file operations. Comparing these two enables detection of 'timestomping' attacks where a user modifies $SI times to hide malicious activity, making them essential for high-fidelity forensic analysis.

Answer

$DATA and $ATTRIBUTE_LIST

Answer

$STANDARD_INFORMATION and $DATA

Answer

$FILE_NAME and $INDEX_ROOT

Answer

$LOGGED_UTILITY_STREAM and $STANDARD_INFORMATION

Question 7

Based on the provided MFT exhibit, what forensic conclusion can be drawn regarding this file?

Accepted Answer

The file timestamps have been manipulated (timestomped).. The $SI (Standard Information) timestamp is earlier than the $FN (File Name) timestamp. Since $SI is user-mode modifiable and $FN is kernel-controlled, this discrepancy suggests that the file timestamps were likely modified by an anti-forensic tool (timestomping). $FN represents the 'true' system time, and the difference proves the $SI metadata does not reflect the actual file modification history.

Answer

The file system is corrupted and requires chkdsk.

Answer

The file was recently moved to a new volume.

Answer

The file was created using a non-Windows utility.

Question 8

Which THREE of the following are valid NTFS system files that reside in the Master File Table?

Accepted Answer

$MFT. NTFS uses the first 16 MFT records to store core system files that manage the volume. These include $MFT (the master file table), $LogFile (for transaction logging), $Volume (volume metadata), $Bitmap (space management), and $Root (root directory). Identifying these is critical because they provide the framework for understanding how data is organized, tracked, and protected against power failures or system crashes on the volume.

Answer

$UserActivity

Answer

$Registry

Question 9

Which THREE items are included in the $STANDARD_INFORMATION ($SI) attribute of an MFT record?

Accepted Answer

File Modification Timestamp. $SI is the primary attribute for file timestamps (Modified, Accessed, Created, and Birth/MFT Change). It also includes flags like Read-Only, Hidden, and System. Because it is easily modified by user-space, it is the primary target for timestomping. Analysts must contrast these with the $FILE_NAME attributes to identify inconsistencies that suggest malicious activity or evidence tampering by an intruder.

Answer

Data Run Offsets

Answer

Parent Directory ID

Question 10

Based on the MFT exhibit provided, what is the status of this file?

Accepted Answer

The file has been deleted from the disk.. A flag of 0x00 indicates the MFT record is marked as 'free' (deleted). The absence of the $DATA attribute confirms that the file has been unlinked from the filesystem. This is a common scenario in forensic investigations where an analyst is looking for evidence of file deletion; the MFT entry persists until the system overwrites it with new data.

Answer

The file is an active, read-only system file.

Answer

The file is currently being accessed by a process.

Answer

The file is a directory that is empty.

Question 11

A compromised Windows 10 workstation was imaged after an intruder deleted several files. You are examining the NTFS $MFT for evidence of file deletion. Which two MFT record header fields indicate that an MFT entry is no longer in use and was previously allocated to a file? (Choose two.)

Accepted Answer

The Flags field in the MFT record header has the in-use bit cleared (0x00).. The MFT record header contains the Flags field, which includes an in-use bit, and the Sequence Number, which is incremented when the record is freed. Together, these fields allow an analyst to determine that an MFT entry is no longer allocated and was previously used. Other attributes like timestamps or $DATA residency do not directly indicate deletion status.

Answer

The $FILE_NAME attribute contains a namespace value of 2 (Win32 & DOS).

Answer

The record's $DATA attribute is non-resident and its allocated size is zero.

Answer

The $STANDARD_INFORMATION attribute's MFT change time ($MFT Modified) is later than the $FILE_NAME attribute's creation timestamp.

Question 12

You are examining a Windows 10 workstation and find that a user's Documents folder contains a file named 'budget.xlsx' with an MFT entry that has a $STANDARD_INFORMATION attribute with creation time 2023-08-10 09:15:00 and a $FILE_NAME attribute with creation time 2023-07-01 14:20:00. The $STANDARD_INFORMATION timestamps are all within a few seconds of each other, while the $FILE_NAME timestamps are from a month earlier. What is the most likely explanation for this discrepancy?

Accepted Answer

The file was created on 2023-07-01, and its $STANDARD_INFORMATION timestamps were later modified by a timestomping tool.. The $FILE_NAME attribute timestamps are only updated by the file system during creation, renaming, or moving, and cannot be directly modified by user-mode tools. In contrast, $STANDARD_INFORMATION timestamps can be set by APIs like SetFileTime. When $STANDARD_INFORMATION timestamps are newer and uniform, it indicates timestomping to make the file appear created later than it actually was.

Answer

The file was created on 2023-08-10, and the $FILE_NAME timestamps were not updated due to a file system bug.

Answer

The file was copied from an external drive on 2023-08-10, preserving the original $FILE_NAME timestamps from the source.

Answer

The file was created on 2023-07-01, and the $STANDARD_INFORMATION timestamps were updated on 2023-08-10 by a legitimate application that modifies file metadata.

Question 13

A forensic analyst is examining an NTFS volume and discovers that several MFT entries contain a $FILE_NAME attribute with a namespace value of 2 (POSIX). The analyst also notes that the corresponding $STANDARD_INFORMATION attribute shows a creation timestamp that is later than the modification timestamp. What is the most likely explanation for this discrepancy?

Accepted Answer

The file's $STANDARD_INFORMATION timestamps were likely manipulated, as the creation time being later than the modification time is a common indicator of timestomping.. A creation timestamp that is later than the modification timestamp in $STANDARD_INFORMATION is a classic anomaly indicating timestomping. Legitimate file operations rarely produce this pattern. The $FILE_NAME attribute often retains original timestamps, providing a basis for comparison. Thus, the most likely explanation is deliberate manipulation of the $STANDARD_INFORMATION timestamps.

Answer

The file was moved from a different volume, and NTFS preserved the original $FILE_NAME timestamps while updating $STANDARD_INFORMATION on the new volume.

Answer

The file was created on a POSIX-compliant system, which does not update the $STANDARD_INFORMATION timestamps correctly.

Answer

The file's timestamps were modified using a tool that only updates the $FILE_NAME timestamps, leaving the $STANDARD_INFORMATION timestamps inconsistent.

Question 14

During an investigation of a compromised Windows server, an analyst finds that a suspicious executable's $STANDARD_INFORMATION timestamps show a creation time earlier than the volume's format date, while the $FILE_NAME timestamps appear consistent with recent activity. The analyst wants to determine whether the timestamps were manipulated using a known timestomping technique. Which NTFS artifact provides the most reliable evidence of timestomping in this scenario?

Accepted Answer

The $FILE_NAME attribute's creation timestamp, because it cannot be modified by user-mode APIs. The $FILE_NAME attribute timestamps are updated by the file system when a file is created, renamed, or moved, and they are not directly writable through common user-mode APIs used by timestomping tools. When they conflict with $STANDARD_INFORMATION timestamps that show an impossible creation date, the discrepancy is strong evidence of manipulation.

Answer

The $DATA attribute's allocated size, because timestomping changes the file's logical size

Answer

The $SECURITY_DESCRIPTOR attribute, because timestomping requires privilege escalation

Answer

The $LOGGED_UTILITY_STREAM attribute, because it records all timestamp modifications

Question 15

During a forensic examination of an NTFS volume, an analyst observes that a file's $STANDARD_INFORMATION timestamps show a Modified time of 2024-03-10 14:22:00, while the $FILE_NAME timestamps show a Modified time of 2024-03-08 09:15:00. The file is not a system file and has no apparent reason for the discrepancy. What is the most likely explanation for this difference?

Accepted Answer

The $STANDARD_INFORMATION timestamps were updated by a subsequent file modification, while the $FILE_NAME timestamps reflect the time of the last rename or move.. The $STANDARD_INFORMATION attribute timestamps are updated when file content changes, whereas $FILE_NAME timestamps are updated when the file is renamed or moved. A later Modified time in $STANDARD_INFORMATION than in $FILE_NAME indicates the file was modified after its last rename or move. This is a normal NTFS behavior and not necessarily indicative of malicious activity, making it the most plausible explanation for the discrepancy.

Answer

The file was copied from another NTFS volume, and the $FILE_NAME timestamps reflect the original creation time.

Answer

The file was renamed, causing the $FILE_NAME timestamps to be updated while $STANDARD_INFORMATION remained unchanged.

Answer

The $FILE_NAME timestamps were updated by a timestomping tool that only modified $STANDARD_INFORMATION.