GCFA Practice Question: Introduction to File System Timeline Forensics
A forensic analyst is creating a timeline from a Windows 10 workstation using fls and mactime from The Sleuth Kit. The analyst notices that the bodyfile contains entries with timestamps that appear to be off by several hours compared to the wall-clock time the incident was reported. The system is known to be set to UTC in the BIOS. Which action best ensures the timeline is correctly aligned for reporting?
⚠ Common exam trap
The trap here is assuming that timestamps must be converted to local time to be useful, when UTC normalization is the defensible choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the time zone configuration and document whether timestamps are stored in UTC, then normalize all timeline entries to UTC for comparison.
NTFS timestamps are recorded in UTC, so a timeline built from them should be normalized to UTC to avoid ambiguity and to allow correlation with other UTC-based sources such as event logs. Documenting the system's time zone configuration provides context for user-facing times but does not change the underlying UTC values. Arbitrary adjustment of timestamps undermines the integrity of the timeline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the Windows time zone setting from the registry to convert the timestamps to local time before analysis.
Why it's wrong here
Applying the local time zone may help present the data in a familiar frame, but it can also introduce errors if the time zone or daylight saving rules are misapplied. For forensic reporting, timestamps should be normalized to a consistent reference such as UTC rather than converted to local time.
- ✗
Discard the bodyfile and regenerate it using a tool that automatically converts timestamps to the analyst's local time zone.
Why it's wrong here
Regenerating with automatic local time conversion can introduce the same ambiguity and may lose the original UTC values. The bodyfile should be preserved as extracted; normalization should be a separate, documented step rather than a tool default that obscures the original data.
- ✗
Adjust each timestamp by the offset observed in the bodyfile until the timeline matches the incident report time.
Why it's wrong here
Manually adjusting timestamps to match an expected time is a form of evidence alteration. It can hide genuine discrepancies and is not defensible. The correct approach is to understand the source time zone and normalize consistently, not to force the data to fit a narrative.
- ✓
Verify the time zone configuration and document whether timestamps are stored in UTC, then normalize all timeline entries to UTC for comparison.
Why this is correct
NTFS stores timestamps in UTC, so normalizing the timeline to UTC removes ambiguity and ensures consistency across sources. Documenting the system's time zone configuration captures the context needed to interpret any user-facing times and supports a defensible report.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.