GCFA Windows Artifact Analysis Practice Question
An analyst is reviewing a Windows 10 system and wants to determine the last time a user accessed a specific file. The analyst examines the file's NTFS standard information attributes and finds that the last access time is not updated. What is the most likely reason for this?
⚠ Common exam trap
The trap here is assuming that last access time is always updated, when in fact it is disabled by default, leading analysts to draw incorrect conclusions about file access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NTFS last access time updates are disabled by default.
By default, Windows disables last access time updates to reduce disk I/O. The registry value NtfsDisableLastAccessUpdate controls this, and it is set to 1 on most modern systems. As a result, the last access time may not reflect recent file accesses, making it unreliable for forensic purposes unless the setting has been changed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NTFS last access time updates are disabled by default.
Why this is correct
Windows disables last access time updates by default to improve performance. This behavior is controlled by the registry value NtfsDisableLastAccessUpdate, which is set to 1 by default in modern Windows versions. Therefore, the last access time is not updated when files are accessed, explaining why the analyst sees no recent timestamp.
- ✗
The file has the 'N' attribute set.
Why it's wrong here
The 'N' attribute in NTFS is not a standard attribute for files; it might refer to the 'Not content indexed' attribute, but that does not affect last access time updates. The 'N' attribute is not related to last access time behavior. Therefore, this is not the correct explanation.
- ✗
The file system is mounted as read-only.
Why it's wrong here
If the file system were mounted as read-only, no writes would occur, but the last access time would still be updated on read operations if the feature were enabled. However, a read-only mount is not typical for a system drive and would not specifically explain why last access time is not updating. This is not the most likely reason.
- ✗
The file is on a network share.
Why it's wrong here
If the file were on a network share, the last access time might be managed by the remote server, but the local NTFS attributes would not reflect accesses. However, the scenario specifies that the analyst is examining NTFS standard information attributes, implying a local file. Thus, network share is not the reason for the lack of updates.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.