GCFA Practice Question: Introduction to File System Timeline Forensics
An analyst is examining an NTFS volume and notices that a file's MFT entry shows a modification time earlier than its creation time. What is the most likely cause for this anomaly?
⚠ Common exam trap
Candidates tend to immediately suspect only malware timestomping, forgetting that standard administrative actions like moving a file across volumes can also alter MFT timestamps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was moved from another volume or manipulated using timestomping techniques.
This anomaly is frequently caused by the 'timestomping' technique or a file move operation where the original metadata is preserved. By understanding file system internals, an analyst recognizes that MFT entry times are susceptible to manipulation via user-mode tools or low-level API calls. Detecting these inconsistencies is critical for identifying anti-forensics activity or specific file system behaviors that could lead to misinterpretation of the true timeline of events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file system is corrupted and requires an immediate CHKDSK operation.
Why it's wrong here
File system corruption typically manifests as missing clusters or circular references rather than logical discrepancies between creation and modification timestamps. Running CHKDSK would likely destroy vital forensic evidence before it could be properly documented, making this an improper response for an analyst investigating a potential incident or artifact manipulation.
- ✗
The operating system experienced a clock drift during the file write process.
Why it's wrong here
Clock drift impacts system-wide logs and synchronization across networks but rarely affects the internal metadata of a single MFT record relative to its own fields. While time synchronization is a common issue in distributed forensics, it does not explain how a modification timestamp could logically precede a creation timestamp.
- ✓
The file was moved from another volume or manipulated using timestomping techniques.
Why this is correct
Moving a file across volumes creates a new entry with an updated creation time, while copying or direct metadata manipulation can force the modification time to an older value. Recognizing this behavior is essential because attackers often use tools to modify these attributes, attempting to blend malicious files into existing directory structures.
- ✗
The master file table is using short filename (8.3) format which ignores creation time.
Why it's wrong here
Short filenames in NTFS are an alternative naming convention for compatibility and do not overwrite the standard file information attributes. The base MFT record for a file always contains the standard information attribute, which stores the full resolution timestamps regardless of whether a short filename is also present.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.