CHFI Storage Forensics and File System Analysis Practice Question
During a forensic examination of an NTFS drive, an analyst runs 'fsutil usn readjournal C:' and observes a large number of USN journal entries for a specific file after a certain date. The file's $MFT record shows a last modified timestamp far earlier than the journal entries. What does this discrepancy suggest?
⚠ Common exam trap
Many candidates assume the USN journal only tracks data content changes, not metadata changes, leading them to incorrectly attribute the discrepancy to corruption or shadow copies instead of recognizing it as evidence of timestomping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation
The USN journal records all changes to files and directories on an NTFS volume, including metadata modifications. When the USN journal shows numerous entries after a date but the $MFT record's last modified timestamp is earlier, it indicates that the file's metadata (e.g., timestamps, ADS) was altered without updating the $MFT's last modified field—a classic sign of timestomping or ADS manipulation. This discrepancy arises because timestomping tools can directly modify $MFT attributes while the USN journal still logs the change event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The file's metadata was modified without changing its content, possibly using timestomping or ADS manipulation
Why this is correct
A recorded USN journal entry that does not correspond to an observable MFT timestamp change indicates that metadata was altered without updating the file's content. Attackers commonly use timestomping to directly modify $STANDARD_INFORMATION or $FILE_NAME timestamps in the MFT, bypassing the normal NTFS APIs that would trigger a journaled update; alternatively, ADS manipulation can change attribute-level metadata while leaving the main file data untouched. The consistency of the journal and MFT in this case makes accidental or corrupted behavior unlikely, pointing to deliberate anti-forensic action.
- ✗
The file is a system file that is excluded from USN journaling
Why it's wrong here
The USN Change Journal tracks changes to every file on an NTFS volume, including system files, boot files, and the $MFT itself. No class of file is excluded from journaling under normal operation; even the system files that make up the journal are journaled, and only a process opening a file with the FILE_FLAG_BACKUP_SEMANTICS flag could avoid generating an entry, which is a deliberate exception rather than a general rule. A file excluded from journaling would simply produce no USN record at all, not the observed mismatch between the journal and MFT timestamps.
- ✗
The file system is corrupted and the MFT is not updating correctly
Why it's wrong here
While MFT corruption could in theory cause timestamps to become stale or inconsistent, the existence of a consistent, readable USN journal entry for the file is evidence that the file system's metadata structures are functioning correctly. Corruption typically manifests as one or more Windows error messages, CHKDSK flags, or widespread access failures far beyond a single file's metadata, and it would not selectively clear a timestamp while preserving the journal's accounting. The scenario describes a targeted discrepancy that corruption cannot explain without also producing other observable file-system failures.
- ✗
The file was accessed via a mounted volume shadow copy, which does not update MFT
Why it's wrong here
Accessing a file via a mounted Volume Shadow Copy (VSC) reads a point-in-time snapshot of the file's data and metadata; it does not modify the live MFT or the original file's attributes. Because the VSC snapshot is read-only and maintained by VSS, any access does not create USN journal entries in the live volume's journal, nor would it cause timestamps to remain stale in the original file. The described mismatch—a journal record with unchanged MFT timestamps—cannot result from VSC access, as that path generates no journal activity for the original file at all.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.