GCFA Practice Question: Introduction to File System Timeline Forensics
A forensic analyst is examining a Linux ext4 file system and wants to determine when a file's metadata (such as permissions or ownership) was last changed. Which timestamp should they examine?
⚠ Common exam trap
Many exam-takers confuse ctime with creation time; ctime stands for change time, not creation time, and is updated on metadata changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ctime
On Linux ext4, ctime is updated when file metadata changes, such as permissions or ownership. mtime reflects content changes, atime reflects access, and btime is creation time. Therefore, ctime is the correct timestamp to determine when metadata was last altered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ctime
Why this is correct
ctime (change time) is updated whenever the file's metadata changes, including permissions, ownership, or when the file is renamed. It is not the creation time. In this scenario, the analyst needs the time of metadata change, so ctime is the correct timestamp. It is stored in the inode and is crucial for tracking administrative changes.
- ✗
atime
Why it's wrong here
atime records the last time the file was accessed (e.g., read). It is updated when the file is opened or read, not when metadata changes. Since the question asks about metadata changes, atime is irrelevant. Relying on atime would give the access time, not the metadata change time, and thus is incorrect.
- ✗
btime
Why it's wrong here
btime (birth time) records when the file was created on the file system. It does not change after creation, regardless of metadata modifications. Since the question asks for the last metadata change, btime is not applicable. Examining btime would provide the creation time, which is not the requested information.
- ✗
mtime
Why it's wrong here
mtime indicates the last time the file's content was modified. It does not change when metadata such as permissions or ownership is altered. In this scenario, the analyst is interested in metadata changes, not content changes. Therefore, mtime would not provide the correct information and could mislead the investigation.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.