GCFA File System Timeline Artifact Analysis Practice Question
Exhibit
USN Journal Entry: Reason: Data_Extend | Timestamp: 2023-05-01 14:00:05 Reason: File_Create | Timestamp: 2023-05-01 14:00:01
Refer to the exhibit. What can be inferred about the file activity?
⚠ Common exam trap
Candidates often misinterpret individual USN Journal entries in isolation, failing to recognize that the sequence of events (Create followed by Data_Extend) is required to confirm actual file population.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file was created and then populated with data.
The USN Journal logs multiple reasons for a single file entry. The 'File_Create' event followed by 'Data_Extend' indicates that a file was created and immediately populated with data. This is a common pattern for legitimate software installations or file writes. Identifying this sequence helps investigators differentiate between simple file creation and the actual writing of content, which is key to confirming if a file was just an empty shell or a functional payload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file was created and immediately deleted.
Why it's wrong here
A 'Data_Extend' reason following 'File_Create' indicates that content was written to the file. If the file were immediately deleted, there would be a subsequent 'File_Delete' entry in the USN Journal. The absence of a deletion reason means the file persisted on the system after the write operation.
- ✓
The file was created and then populated with data.
Why this is correct
The 'File_Create' event followed by the 'Data_Extend' event demonstrates that the file was initialized on the file system and then subsequently received data. This sequential logging is characteristic of standard file write operations performed by applications or the operating system, providing a clear timeline of file usage.
- ✗
The file system is experiencing metadata corruption.
Why it's wrong here
The USN Journal is designed to record these exact sequences as normal file system behavior. Seeing multiple entries for a single file is expected functionality, not evidence of corruption. Attributing this to corruption is a misinterpretation of how the USN journal captures the lifecycle of a file during operation.
- ✗
The timestamps reflect a timestomping attempt.
Why it's wrong here
The USN Journal is a kernel-level log that is significantly harder to manipulate than MFT attributes. A sequential, logically ordered series of events like 'Create' followed by 'Extend' is typical of normal system activity. Without evidence of gaps or illogical sequencing, there is no basis to suspect timestomping here.
About these practice questions
One of 292 original GCFA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.