GCFA Practice Question: Introduction to File System Timeline Forensics
An investigator is analyzing a Linux ext4 file system and needs to determine when a file's content was last modified. The file's inode contains ctime, mtime, and atime fields. Which timestamp should the investigator use to answer this specific question?
⚠ Common exam trap
A common mix-up: candidates confuse ctime with content modification time, when ctime actually tracks inode metadata changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
mtime
In ext4, the mtime (modification time) field in the inode is updated whenever the file's content changes. It is the appropriate timestamp for determining when the file's data was last written. Other timestamps like ctime and atime serve different purposes and do not reflect content modification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ctime
Why it's wrong here
ctime indicates when the inode metadata was last changed, such as permissions or ownership, not when the file content was modified. A file's content modification does not necessarily update ctime if only the data blocks change without metadata updates. Using ctime would answer a different question about metadata changes, not content modification.
- ✗
crtime
Why it's wrong here
crtime is the creation time of the file, available in ext4 through the extra inode fields. It records when the file was first created, not when its content was last modified. A file can be modified many times after creation, so crtime does not answer the question about the most recent content change.
- ✓
mtime
Why this is correct
mtime records the last time the file's content was modified. In ext4, any write to the file data updates mtime, making it the correct timestamp for determining when the content last changed. This directly answers the investigator's question about content modification time, assuming no timestamp manipulation has occurred.
- ✗
atime
Why it's wrong here
atime tracks the last time the file was accessed, such as when it was read or executed. It does not reflect content modification. Access can occur without any change to the file data, so atime is not suitable for determining when the content was last modified. It would mislead the investigator if used for this purpose.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.