GCFA File System Timeline Artifact Analysis Practice Question
During an investigation of an ext4 file system, an analyst runs `fls -r -m /` and `mactime` to build a body file. The analyst observes that many deleted files show a dtime in the body file, but the mactime timeline places those dtime entries at the time the file was deleted. A colleague claims that dtime in ext4 always represents the time the inode was last modified. Which statement correctly describes ext4 dtime behavior in this timeline context?
⚠ Common exam trap
The trap here is conflating ext4 dtime with mtime, when dtime specifically records deletion and is the only timestamp that mactime maps to a deletion event.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dtime is the inode deletion time and is populated when the inode is unlinked; mactime correctly maps it to the deletion event.
In ext4, the dtime field in the inode records when the file was deleted or unlinked. When `fls` extracts deleted inodes into a body file, it includes dtime, and `mactime` correctly renders it as a deletion event. Confusing dtime with mtime, atime, or crtime leads to timeline errors. The colleague's claim is incorrect because mtime is a separate field.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
dtime is the inode deletion time and is populated when the inode is unlinked; mactime correctly maps it to the deletion event.
Why this is correct
In ext4, the dtime field records when the inode was deleted or unlinked. When `fls` extracts deleted entries and writes a body file, it includes dtime, and `mactime` renders it as a deletion event. This is why the timeline places dtime entries at the deletion moment, not at a modification time. The colleague's claim confuses dtime with mtime.
- ✗
dtime is the inode modification time and is only populated for deleted files; mactime mislabels it as deletion time.
Why it's wrong here
Inode modification time is stored in mtime, not dtime. The dtime field specifically records deletion time and is populated when the inode is unlinked. For deleted files, both mtime and dtime may be present. Claiming that mactime mislabels dtime as deletion time is incorrect because mactime intentionally maps dtime to a deletion event.
- ✗
dtime is the time the inode was created and is preserved after deletion for timeline reconstruction.
Why it's wrong here
Inode creation time in ext4 is stored in crtime, not dtime. The dtime field is set at deletion and is not a creation timestamp. Preserving a creation time after deletion is not what dtime does. Analysts must use crtime, mtime, atime, and ctime for creation and modification context, and dtime specifically for deletion events.
- ✗
dtime is the time the inode was last accessed and is updated whenever a deleted file is read during forensic acquisition.
Why it's wrong here
Last access time is stored in atime, not dtime. Reading a deleted file during forensic acquisition can update atime in some file systems, but ext4 typically mounts with relatime or noatime, and dtime remains the deletion timestamp. Confusing dtime with atime leads to incorrect timeline interpretation.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.