GCFA Practice Question: Introduction to File System Timeline Forensics
A forensic analyst is using a tool to generate a file system timeline from an NTFS volume. The tool outputs timestamps with nanosecond precision, but the analyst knows that NTFS stores timestamps with 100-nanosecond resolution. What is the most likely reason for the discrepancy?
⚠ Common exam trap
The trap here is believing that the displayed precision reflects the actual storage resolution, leading to overconfidence in sub-100-nanosecond event ordering.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The tool is converting the 100-nanosecond intervals to nanoseconds and displaying additional precision that does not exist.
NTFS timestamps are stored as 64-bit values in 100-nanosecond intervals. When a forensic tool displays them, it often converts to nanoseconds for readability, which can introduce apparent nanosecond precision. The underlying resolution remains 100 nanoseconds, so the extra digits are not meaningful for timeline granularity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The tool is incorrectly interpreting the timestamp format, treating them as nanoseconds instead of 100-nanosecond intervals.
Why it's wrong here
If the tool treated 100-nanosecond intervals as nanoseconds, the displayed times would be off by a factor of 100, resulting in dates far in the past or future, not just extra decimal places. The scenario describes nanosecond precision in the output, not a gross time shift, so this is not the likely cause.
- ✗
The tool is reading timestamps from a different file system that stores nanosecond precision.
Why it's wrong here
If the tool were reading from a different file system, the timestamps would not be NTFS timestamps. The question specifies an NTFS volume, so the tool is reading NTFS metadata. NTFS does not store nanosecond precision, so this explanation is incorrect and would mislead the analyst about the source of the timestamps.
- ✓
The tool is converting the 100-nanosecond intervals to nanoseconds and displaying additional precision that does not exist.
Why this is correct
NTFS stores timestamps as 64-bit values representing the number of 100-nanosecond intervals since January 1, 1601. When a tool converts these to nanoseconds, it multiplies by 100, which can result in values that appear to have nanosecond precision but are actually limited to 100-nanosecond granularity. The extra digits are an artifact of conversion, not additional precision.
- ✗
The NTFS file system on this volume has been upgraded to support nanosecond timestamps.
Why it's wrong here
NTFS has always used 100-nanosecond intervals for timestamp storage and has not been upgraded to support nanosecond precision. No standard NTFS version stores nanosecond timestamps. This option is factually incorrect and would lead the analyst to misunderstand the fundamental resolution of NTFS timestamps.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.