GCFA File System Timeline Artifact Analysis Practice Question
A forensic analyst is examining a Windows 10 system and finds a prefetch file named `CMD.EXE-1234ABCD.pf`. The analyst wants to determine the last time the program was executed. Which timestamp in the prefetch file should the analyst use?
⚠ Common exam trap
The trap here is using the prefetch file's file system Modified timestamp instead of parsing the internal last run timestamp, which is specifically designed to record execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The last run time stored internally in the prefetch file's header.
Prefetch files store an internal last run timestamp in their header, which is updated each time the program executes. Forensic tools like PECmd extract this timestamp, making it the most direct evidence of last execution. File system timestamps such as $STANDARD_INFORMATION Modified can correlate but are not as precise for execution time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file's $STANDARD_INFORMATION Modified timestamp in the MFT.
Why it's wrong here
The $STANDARD_INFORMATION Modified timestamp reflects when the prefetch file was last written, which often corresponds to execution, but it can be affected by other factors such as prefetch updates or system activity. The prefetch file also contains internal timestamps that are more directly tied to execution. Relying solely on the MFT timestamp may introduce ambiguity.
- ✗
The file's $FILE_NAME Created timestamp in the MFT.
Why it's wrong here
The $FILE_NAME Created timestamp indicates when the prefetch file was first created, not when the program was last executed. Prefetch files are created on first execution and then updated, so the Created timestamp only shows the initial run. It cannot provide the last execution time, making it unsuitable for this purpose.
- ✓
The last run time stored internally in the prefetch file's header.
Why this is correct
Prefetch files contain internal metadata, including a last run timestamp in the file header. This timestamp is updated when the program is executed and is a more direct indicator of execution than the file system timestamps. Tools like PECmd parse this internal timestamp, which is why it is the preferred artifact for determining last execution time.
- ✗
The volume's $LogFile entry for the prefetch file.
Why it's wrong here
$LogFile records file system metadata transactions and can show when the prefetch file was modified, but it does not store application execution times directly. Parsing $LogFile is complex and typically used for file system reconstruction, not for determining program execution. The internal prefetch timestamp is the correct artifact for last run time.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.