GCFA Practice Question: Introduction to File System Timeline Forensics
During a forensic investigation of an NTFS volume, an analyst notices that the $MFT record for a suspicious executable shows a modified time earlier than its creation time. What does this specific anomaly typically indicate?
⚠ Common exam trap
Candidates often assume this is a sign of timestomping or system clock manipulation. They overlook the standard behavior of file systems when copying files across volumes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was copied from another location, preserving the original modified timestamp while generating a new creation timestamp.
An $MFT record reflecting a modified time earlier than the creation time frequently occurs when a file is copied rather than moved. The copy operation assigns a new creation timestamp to the destination file while preserving the original modified timestamp from the source file. Recognizing this artifact helps forensic analysts trace the origin of stolen payloads across network shares or external drives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file system metadata was actively corrupted by malware to hinder timeline analysis.
Why it's wrong here
Malware typically alters timestamps to match benign system files rather than leaving glaring chronological contradictions like an earlier modified time. Such systematic anti-forensic tampering is usually more subtle and rarely results in mismatched creation and modification anomalies without additional file system inconsistencies.
- ✓
The file was copied from another location, preserving the original modified timestamp while generating a new creation timestamp.
Why this is correct
Copying a file to a new NTFS destination assigns a fresh creation timestamp representing the exact moment of creation on the target volume. However, the modified timestamp is often preserved from the source file, creating an apparent chronological inversion that immediately flags the file as a copy.
- ✗
The operating system experienced a severe clock synchronization failure during the write operation.
Why it's wrong here
System clock skews usually affect all concurrent file operations uniformly rather than selectively inverting individual file timestamps within a single $MFT record. Chronological inversions are structural artifacts of file system mechanics rather than transient hardware clock errors.
- ✗
An automated defragmentation utility reorganized the cluster chain and inadvertently swapped the metadata values.
Why it's wrong here
Defragmentation utilities relocate cluster data and update mapping pointers, but they do not alter standard NTFS file timestamps within the $MFT record. Modifying file metadata during optimization would violate file integrity and disrupt standard operating system tracking mechanisms.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.