GCFA Practice Question: Introduction to File System Timeline Forensics
An investigator notices that a file's 'Birth' time is later than its 'Modification' time. What is the most likely forensic explanation for this phenomenon?
⚠ Common exam trap
Candidates often assume the file is corrupted or the system clock is broken, failing to recognize the 'time-traveling' artifact common when files are copied from external sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was copied from an external source
This scenario, often called 'time-traveling' files, typically occurs when a file is copied from another location. The copy process assigns a new 'Birth' time (the time of the copy), but the 'Modification' time is often preserved from the original source file. Recognizing this artifact is crucial for distinguishing between files created locally and those that were moved or copied by an attacker into the environment during an incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file system is corrupted
Why it's wrong here
File system corruption usually manifests as invalid MFT entries or cross-linked clusters, not as a logically inconsistent relationship between creation and modification timestamps. While corruption can occur, it is an unlikely explanation for a predictable pattern like birth times being newer than modification times in a functioning system.
- ✓
The file was copied from an external source
Why this is correct
When copying a file, the OS creates a new entry on the destination volume, setting a new birth time. However, many copy utilities and APIs preserve the original modification timestamp from the source file. This results in the metadata anomaly where the file appears to be 'modified' before it was 'born'.
- ✗
The system clock was updated via NTP
Why it's wrong here
NTP updates shift the system time globally. If an NTP update occurred, it would potentially impact all timestamps during that window, but it would not selectively reverse the order of birth and modification times for a specific file. This logic is inherent to the file copy process, not clock synchronization.
- ✗
The file is a system-level shadow copy
Why it's wrong here
Shadow copies are snapshots of the file system state. They do not alter the relationship between birth and modification timestamps within the files they contain. The timestamps in a shadow copy reflect the state of the original file at the time the snapshot was taken, maintaining the original metadata.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.