GCFA Practice Question: Introduction to File System Timeline Forensics
During a forensic investigation of a Windows 10 system, an analyst observes that a file's $STANDARD_INFORMATION creation timestamp is 2020-01-01 10:00:00, while its $FILE_NAME creation timestamp is 2020-01-01 10:00:05. The system time zone is UTC-5. The analyst also notes that the file's $STANDARD_INFORMATION modification timestamp is 2020-01-01 10:00:00. What is the most likely explanation for the 5-second difference between the creation timestamps?
⚠ Common exam trap
The trap here is assuming that any discrepancy between $STANDARD_INFORMATION and $FILE_NAME timestamps indicates malicious activity, when in fact minor differences are expected due to normal system behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 5-second difference is normal because $STANDARD_INFORMATION and $FILE_NAME timestamps are updated at different times during file creation.
A small difference of a few seconds between $STANDARD_INFORMATION and $FILE_NAME creation timestamps is normal and occurs because the two sets of timestamps are written at slightly different times during file creation. It is not necessarily an indicator of timestomping or other manipulation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file was timestomped, and the attacker set the $STANDARD_INFORMATION creation time to match the modification time.
Why it's wrong here
Timestomping often sets creation and modification times to the same value, but it typically would not create a 5-second difference between $STANDARD_INFORMATION and $FILE_NAME creation times. The difference suggests a normal system behavior rather than deliberate manipulation.
- ✗
The 5-second difference indicates that the file was copied from another volume, and the $FILE_NAME creation time was updated to the copy time.
Why it's wrong here
When a file is copied, the $STANDARD_INFORMATION timestamps are typically updated to the current time, while the $FILE_NAME timestamps may retain the original creation time. This would result in a larger discrepancy and in the opposite direction, not a 5-second difference where $STANDARD_INFORMATION is earlier.
- ✗
The 5-second difference is due to the file system tunneling feature, which preserves the original creation time from a deleted file with the same name.
Why it's wrong here
File system tunneling can cause a new file to inherit the creation time of a previously deleted file with the same name, but it would result in the $STANDARD_INFORMATION creation time being older than the $FILE_NAME creation time, not a 5-second difference in the other direction.
- ✓
The 5-second difference is normal because $STANDARD_INFORMATION and $FILE_NAME timestamps are updated at different times during file creation.
Why this is correct
During file creation, the $STANDARD_INFORMATION timestamps are set first, and the $FILE_NAME timestamps are set slightly later. A small difference of a few seconds is common and not indicative of tampering. This is the most likely explanation for the observed 5-second gap.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.