GCFA File System Timeline Artifact Analysis Practice Question
An investigator is analyzing MACB timelines on a Windows system and needs to differentiate between a file being copied versus being moved within the same NTFS volume. Which timeline artifact behavior distinguishes an intra-volume file move from a file copy operation?
⚠ Common exam trap
Candidates often assume that moving a file generates a new MFT record, failing to distinguish between the pointer updates of a move and the creation of a new entry during copy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An intra-volume move updates the parent directory index while preserving the original $MFT record's creation timestamp, whereas a copy generates a new $MFT record with a new creation time.
Differentiating file movement from copying is essential for tracking data exfiltration and staging on a compromised system. Within the same NTFS volume, a move operation retains the original $MFT record and updates directory pointers, whereas copying creates an entirely new $MFT record with fresh creation timestamps, providing a clear footprint in timeline analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An intra-volume move operation creates a brand-new $MFT record with current creation timestamps, while a copy preserves the original record.
Why it's wrong here
This statement is backward; copying a file allocates an entirely new MFT record with current creation timestamps, whereas moving a file within the same volume preserves the original MFT record and simply updates index parent pointers.
- ✓
An intra-volume move updates the parent directory index while preserving the original $MFT record's creation timestamp, whereas a copy generates a new $MFT record with a new creation time.
Why this is correct
Moving a file within the same NTFS volume reuses the existing MFT record, updating only the parent directory references and ctime. Conversely, copying allocates a completely new MFT record, assigning a fresh creation timestamp to the destination file.
- ✗
Both operations generate identical $MFT records because NTFS abstracts file movement as a symbolic link creation process.
Why it's wrong here
NTFS does not abstract moves as symbolic links; an intra-volume move preserves the file record and updates the $FILE_NAME timestamps, while a copy creates a new record. Symbolic links are distinct reparse points created explicitly, not the mechanism behind rename or move operations within a volume.
- ✗
A file copy updates the $STANDARD_INFORMATION attribute while leaving $FILE_NAME untouched, whereas a move updates both simultaneously.
Why it's wrong here
Both $STANDARD_INFORMATION and $FILE_NAME timestamps are updated by either operation, so this split does not distinguish them. The actual discriminator is that an intra-volume move preserves the original $MFT record number and creation timestamp, whereas a copy generates a new record with fresh timestamps.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.