GCFA Practice Question: Introduction to File System Timeline Forensics
In the context of forensic timeline analysis, what does the term 'Time Skew' refer to?
⚠ Common exam trap
Candidates often treat the system time as absolute truth, failing to account for the drift between the local machine clock and the actual UTC time during multi-system correlation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The discrepancy between the system clock and the actual time
Time skew is the difference between the actual wall-clock time and the time reported by the system under investigation. Identifying and correcting for this skew is a fundamental prerequisite for timeline analysis. If the investigator ignores the skew, all events will be chronologically misaligned, making it impossible to correlate evidence across different machines or correlate logs with file system activity during the incident reconstruction phase.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The difference between local time and UTC
Why it's wrong here
The difference between local time and UTC is known as the time zone offset. While this must be accounted for during analysis, it is a constant, predictable value, not an error or 'skew' caused by system clock drift or intentional manipulation by a threat actor during an incident.
- ✗
The intentional modification of a file's timestamp
Why it's wrong here
The act of intentionally modifying a file's timestamp is called 'timestomping' or 'anti-forensic metadata manipulation'. Time skew specifically refers to the discrepancy in the system's overall clock, not the metadata of individual files, making this term technically distinct from the manipulation of a single file's temporal attributes.
- ✓
The discrepancy between the system clock and the actual time
Why this is correct
Time skew represents the drift or offset of a system clock compared to an accurate reference time. It is a critical factor for forensic analysts to document; failing to account for it will result in an incorrect sequence of events when comparing the evidence against other system logs or external timestamps.
- ✗
The process of normalizing timestamps to a common format
Why it's wrong here
Normalization is the process of converting timestamps from various formats into a standard, machine-readable format. This is a data-processing step, not an inherent error in the system. Time skew is the actual error in the clock itself, whereas normalization is the solution used to handle different formats during analysis.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.