GCFA Practice Question: Introduction to File System Timeline Forensics
During a forensic examination of an NTFS volume, an analyst notices that a file's $STANDARD_INFORMATION timestamps show a modification time of 2023-04-01 10:00:00, but the $FILE_NAME timestamps show a modification time of 2023-03-15 14:30:00. The file is not a system file and has not been renamed. What is the most likely explanation for this discrepancy?
⚠ Common exam trap
The trap here is assuming that any timestamp discrepancy indicates file system corruption, when in fact timestomping is a common anti-forensic technique that targets specific attributes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file's $STANDARD_INFORMATION timestamps were modified by a timestomping tool, while the $FILE_NAME timestamps remained unchanged.
Timestomping tools often alter $STANDARD_INFORMATION timestamps without updating $FILE_NAME timestamps, especially when the file is not renamed. This creates a discrepancy where $STANDARD_INFORMATION shows a later modification time than $FILE_NAME. Since the file was not renamed, the $FILE_NAME timestamps likely reflect the original modification time, indicating tampering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file was copied from another volume, preserving the $FILE_NAME timestamps but updating the $STANDARD_INFORMATION timestamps.
Why it's wrong here
When a file is copied, the new file typically gets new timestamps in both $STANDARD_INFORMATION and $FILE_NAME, reflecting the copy time. However, some copy methods may preserve the original creation time in $STANDARD_INFORMATION but not in $FILE_NAME. In this scenario, the discrepancy is more likely due to timestomping, as the file was not renamed. Copying would not typically cause a later $STANDARD_INFORMATION modification time while leaving $FILE_NAME with an earlier time.
- ✓
The file's $STANDARD_INFORMATION timestamps were modified by a timestomping tool, while the $FILE_NAME timestamps remained unchanged.
Why this is correct
Timestomping tools often target $STANDARD_INFORMATION timestamps because they are easily accessible via user-mode APIs. They may not update $FILE_NAME timestamps, especially if the file was not renamed. This creates a discrepancy where $STANDARD_INFORMATION shows a later modification time than $FILE_NAME. In this scenario, the file was not renamed, so $FILE_NAME timestamps should reflect the original modification time, making timestomping the most likely explanation.
- ✗
The file was moved within the same volume, which updates $STANDARD_INFORMATION but not $FILE_NAME timestamps.
Why it's wrong here
Moving a file within the same volume does not update the $STANDARD_INFORMATION modification timestamp; it only updates the $FILE_NAME timestamps if the file is renamed. If the file is moved without renaming, the $FILE_NAME timestamps remain unchanged. In this scenario, the $STANDARD_INFORMATION time is later, which is the opposite of what a move would cause. Therefore, a move is not the explanation.
- ✗
The file system is corrupted, causing inconsistent timestamps between attributes.
Why it's wrong here
File system corruption can cause various inconsistencies, but a specific pattern where $STANDARD_INFORMATION is later than $FILE_NAME without other signs of corruption is unlikely. Corruption would typically affect multiple files or structures. The scenario describes a single file with a clear discrepancy, which is more consistent with deliberate tampering than random corruption. Thus, corruption is not the most likely explanation.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.