GCFA NTFS Artifact Analysis Practice Question
A forensic analyst is reviewing a Windows 10 workstation suspected of unauthorized data staging. While parsing the Master File Table with a commercial forensic suite, the analyst observes that a suspicious .zip file's $STANDARD_INFORMATION timestamps differ from its $FILE_NAME timestamps by more than six months, and the $FILE_NAME timestamps are older. Which conclusion is most consistent with this artifact pattern?
⚠ Common exam trap
The trap here is assuming that matching timestamps confirm authenticity or that any mismatch indicates corruption, when in fact a systematic mismatch between attribute sets is the recognized timestomping signature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The $STANDARD_INFORMATION timestamps were likely altered by a timestomping utility, while the $FILE_NAME timestamps retained the original values.
NTFS stores two independent timestamp sets per file: $STANDARD_INFORMATION, writable through normal APIs, and $FILE_NAME, set at creation and rename. Anti-forensic tools commonly change only the former, producing a divergence where $FILE_NAME timestamps are older. This pattern is a reliable indicator of timestomping and should prompt deeper timeline analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file was created on a different NTFS volume and later copied onto this workstation using a tool that preserves $FILE_NAME timestamps.
Why it's wrong here
Cross-volume copies generally update $STANDARD_INFORMATION while the $FILE_NAME timestamps track the original creation if the copying utility preserves them; however, the scenario's six-month gap with older $FILE_NAME timestamps is more consistent with deliberate timestamp manipulation than with routine file copying, which typically leaves both sets closer together or updates both.
- ✗
The file was accessed by a backup application that updates only $STANDARD_INFORMATION timestamps during incremental backups.
Why it's wrong here
Backup applications that use the Windows backup API may restore timestamps, but they typically preserve or restore both sets consistently rather than creating a six-month divergence. An incremental backup also would not explain why $FILE_NAME timestamps are older than $STANDARD_INFORMATION timestamps by such a large margin, which points to intentional modification.
- ✓
The $STANDARD_INFORMATION timestamps were likely altered by a timestomping utility, while the $FILE_NAME timestamps retained the original values.
Why this is correct
Timestomping tools such as SetMace or PowerShell's Set-ItemProperty modify $STANDARD_INFORMATION because it is easily writable through the Windows API, but they frequently fail to update $FILE_NAME timestamps, which are only set during file creation or renaming. A large discrepancy where $FILE_NAME is older is a classic indicator of anti-forensic timestamp manipulation on NTFS.
- ✗
The file system is corrupt and the $FILE_NAME attribute should be treated as unreliable, so only the $STANDARD_INFORMATION timestamps should be used for the timeline.
Why it's wrong here
NTFS does not spontaneously produce divergent timestamps without cause; a six-month offset between two attribute sets on a single file is not evidence of corruption. Dismissing the $FILE_NAME timestamps would ignore the most reliable creation indicator, since those timestamps are harder for user-mode tools to modify and are set when the filename is first written.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.