GCFA Practice Question: Introduction to File System Timeline Forensics
During a forensic investigation of a Windows 10 workstation, an analyst reviews the NTFS Master File Table (MFT) and notices that the $STANDARD_INFORMATION timestamps for a suspicious file are all dated 2023-08-15, but the $FILE_NAME timestamps are dated 2024-01-20. The file is located in C:\Users\Public\Downloads. Which of the following best explains this discrepancy?
⚠ Common exam trap
The trap here is assuming that any timestamp discrepancy is due to benign system activity, when in fact it often indicates deliberate timestomping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was likely timestomped, as the $STANDARD_INFORMATION timestamps can be modified by user-mode tools while $FILE_NAME timestamps are harder to alter.
The correct answer is the option describing timestomping. In NTFS, $STANDARD_INFORMATION timestamps are easily modified by user-mode APIs, while $FILE_NAME timestamps are stored in the MFT and are more difficult to change. A large discrepancy where $STANDARD_INFORMATION times are earlier than $FILE_NAME times is a strong indicator of timestomping, often used by attackers to hide malicious files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file system journal ($LogFile) recorded a system time change, causing the $STANDARD_INFORMATION timestamps to be adjusted while the $FILE_NAME timestamps remained unchanged.
Why it's wrong here
This is incorrect because the $LogFile records metadata changes but does not directly alter timestamps in the MFT. A system time change would affect new timestamps but would not selectively modify $STANDARD_INFORMATION while leaving $FILE_NAME untouched; such a pattern is not a typical result of system time adjustments.
- ✓
The file was likely timestomped, as the $STANDARD_INFORMATION timestamps can be modified by user-mode tools while $FILE_NAME timestamps are harder to alter.
Why this is correct
This is correct because timestomping tools typically modify the $STANDARD_INFORMATION attributes, which are easily accessible, while the $FILE_NAME timestamps in the MFT are less commonly altered. The discrepancy between the two sets of timestamps is a classic indicator of timestomping, especially when the $STANDARD_INFORMATION times are earlier than the $FILE_NAME times.
- ✗
The file was copied from another NTFS volume, causing the $STANDARD_INFORMATION timestamps to reflect the original creation time while the $FILE_NAME timestamps reflect the copy time.
Why it's wrong here
This is incorrect because when a file is copied within or between NTFS volumes, the $STANDARD_INFORMATION timestamps are typically updated to the copy time, while the $FILE_NAME timestamps may retain the original creation time if the file is moved. However, the scenario shows the opposite pattern, and copying does not usually create such a large discrepancy in the direction shown.
- ✗
The file was restored from a backup, and the backup software restored the $STANDARD_INFORMATION timestamps but not the $FILE_NAME timestamps.
Why it's wrong here
This is incorrect because backup restoration typically preserves or restores all timestamps consistently. While some backup tools may restore $STANDARD_INFORMATION timestamps, they usually also update $FILE_NAME timestamps to the restoration time or preserve them together; a selective restoration is not standard behavior and would not explain the given discrepancy.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.