GCFA File System Timeline Artifact Analysis Practice Question
An examiner is reviewing an APFS volume from a macOS 13 system. Using a timeline tool that parses APFS metadata, the analyst observes a file whose inode has an added date (birth time) earlier than its modified time, and the file's data stream shows a sparse extent. The case requires establishing the earliest credible creation time for the file. Which APFS attribute should the analyst rely on as the file's creation time?
⚠ Common exam trap
The trap here is treating Spotlight metadata or allocation extents as creation evidence instead of the APFS inode's added time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The inode's added time (crtime) stored in the APFS inode structure
APFS stores a dedicated birth timestamp in each inode, commonly surfaced as added time or crtime, which records when the object was created. This value is maintained by the file system itself and is the correct attribute for establishing a file's creation time. Container-level times and Spotlight extended attributes describe broader or user-space state and can be misleading, while allocation extents reflect block assignment rather than object creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The volume superblock's last modification time for the APFS container
Why it's wrong here
The container superblock modification time reflects changes to the overall APFS container, such as checkpoint updates, not the creation of an individual file. It is a volume-level value and will not correlate to a specific inode's birth. Relying on it would attribute container-wide activity to a single file's creation, producing an incorrect and overly broad timeline entry.
- ✗
The data stream's first extent allocation timestamp in the APFS space manager
Why it's wrong here
The space manager tracks block allocation for copy-on-write and does not expose a per-file creation timestamp. Extent allocation reflects when physical blocks were assigned, which can occur later than file creation due to cloning, defragmentation, or sparse writes. Using extent allocation to infer creation time is unreliable because blocks may be reallocated or shared, so it cannot establish the file's original creation.
- ✗
The extended attribute com.apple.metadata:kMDItemFSCreationDate stored on the file
Why it's wrong here
The kMDItemFSCreationDate extended attribute is maintained by Spotlight metadata importers and can be missing, stale, or rewritten by indexing. It is not the authoritative file system creation timestamp and may not exist on files never indexed. Because it is user-space metadata, it cannot be trusted over the APFS inode's added time when establishing the earliest credible creation time.
- ✓
The inode's added time (crtime) stored in the APFS inode structure
Why this is correct
APFS records a birth/added timestamp (crtime) in the inode, which represents when the file system object was created. It is the closest analog to NTFS $STANDARD_INFORMATION creation time and is the authoritative creation timestamp on APFS. Because APFS is copy-on-write and stores this value in the inode, parsing it directly yields the earliest credible creation time for the file, independent of later modifications.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.