GCFA File System Timeline Artifact Analysis Practice Question
An analyst is reviewing an NTFS file system timeline and notices that a file's $STANDARD_INFORMATION modified timestamp is 2024-01-15 10:00:00, while its $FILE_NAME modified timestamp is 2024-01-15 09:55:00. The file's $MFT record shows a USN journal entry indicating a rename operation at 09:54:00. There is no other metadata. Which of the following is the most likely explanation for the 5-minute difference between the two modified timestamps?
⚠ Common exam trap
It's easy for candidates to confuse which timestamps are updated by rename versus content modification; the $FILE_NAME modified timestamp changes on rename, while the $STANDARD_INFORMATION modified timestamp changes on content modification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was renamed at 09:54:00, which updated the $FILE_NAME timestamp to 09:55:00, and then the content was modified at 10:00:00, updating only the $STANDARD_INFORMATION timestamp.
A rename operation updates the $FILE_NAME attribute timestamps, including the modified time. Later, a content modification updates the $STANDARD_INFORMATION modified timestamp. The 5-minute difference is consistent with a rename at approximately 09:54-09:55, followed by a content modification at 10:00. The USN journal entry corroborates the rename event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file system was mounted with the noatime option, causing the $FILE_NAME timestamp to lag behind the $STANDARD_INFORMATION timestamp.
Why it's wrong here
The noatime mount option affects access timestamps, not modified timestamps, and is typically used on Linux file systems, not NTFS. It would not cause a difference between $FILE_NAME and $STANDARD_INFORMATION modified timestamps. This option is a distractor that confuses file system mount options with NTFS metadata behavior.
- ✗
The $FILE_NAME modified timestamp is updated when the file's content changes, and the $STANDARD_INFORMATION modified timestamp is updated only on rename operations.
Why it's wrong here
This reverses the typical behavior. The $STANDARD_INFORMATION modified timestamp is updated on content changes, while the $FILE_NAME modified timestamp is updated on rename or move operations. The scenario shows a rename in the USN journal and a later content modification, so the timestamps should reflect that order, not the opposite.
- ✗
The file's content was modified at 10:00:00, and the $FILE_NAME timestamp was not updated because the file was not renamed.
Why it's wrong here
If the file's content was modified, the $STANDARD_INFORMATION modified timestamp would update, but the $FILE_NAME modified timestamp typically updates only on rename or move operations, not on content changes. However, the USN journal shows a rename at 09:54:00, which should have updated the $FILE_NAME timestamp to 09:54:00, not 09:55:00. The 5-minute difference suggests another factor.
- ✓
The file was renamed at 09:54:00, which updated the $FILE_NAME timestamp to 09:55:00, and then the content was modified at 10:00:00, updating only the $STANDARD_INFORMATION timestamp.
Why this is correct
A rename operation updates the $FILE_NAME attribute timestamps, including the modified time, to the time of the rename. The USN journal shows a rename at 09:54:00, but the $FILE_NAME modified timestamp is 09:55:00, which could reflect a slight delay or rounding. Later, at 10:00:00, the file's content was modified, updating the $STANDARD_INFORMATION modified timestamp. This sequence explains the 5-minute gap and is consistent with NTFS behavior.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.