GCFA Practice Question: Introduction to File System Timeline Forensics
An analyst acquires a forensic image of a Windows 10 NTFS volume using a write blocker and now needs to build a file system timeline. The analyst wants to include the $STANDARD_INFORMATION timestamps but also wants to detect timestomping by comparing them with the $FILE_NAME timestamps. Which tool should the analyst use to extract both timestamp sets from the MFT and generate a bodyfile for timeline creation?
⚠ Common exam trap
The trap here is assuming that any tool that can parse the MFT will automatically output both $STANDARD_INFORMATION and $FILE_NAME timestamps, when many only report the $STANDARD_INFORMATION set by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MFTECmd
MFTECmd is specifically designed to parse the $MFT and output both $STANDARD_INFORMATION and $FILE_NAME timestamps, enabling direct comparison for timestomping detection. The other tools either do not extract both timestamp sets or are not intended for this purpose.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ntfs-3g
Why it's wrong here
ntfs-3g is a file system driver used to mount NTFS volumes on Linux. It is not a forensic timeline tool and does not extract MFT timestamps or generate bodyfiles. Using it would not provide the timestamp comparison needed to detect timestomping.
- ✗
log2timeline.pl
Why it's wrong here
log2timeline.pl is a legacy Perl script that creates a bodyfile from various sources. While it can parse file system metadata, it does not specifically extract and preserve both $STANDARD_INFORMATION and $FILE_NAME timestamps from NTFS in a way that enables direct timestomp comparison.
- ✓
MFTECmd
Why this is correct
MFTECmd parses the $MFT and outputs both $STANDARD_INFORMATION and $FILE_NAME timestamps in a CSV or bodyfile-compatible format. This allows the analyst to compare the two timestamp sets and detect timestomping, which is exactly what the scenario requires.
- ✗
fls from The Sleuth Kit
Why it's wrong here
fls lists file and directory entries and can output MAC times in bodyfile format, but by default it reports the $STANDARD_INFORMATION timestamps from the MFT. It does not natively extract and output the separate $FILE_NAME timestamps needed for direct timestomp comparison, so it is insufficient for this scenario.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.