GCFA File System Timeline Artifact Analysis Practice Question
Which of the following is true regarding the 'MFT Change' timestamp?
⚠ Common exam trap
Candidates frequently confuse the MFT Change timestamp with the standard file modification time, assuming it tracks content changes rather than structural metadata changes to the MFT record.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It tracks when the file metadata was last modified.
The 'MFT Change' (or 'Entry Modified') timestamp is updated whenever the metadata of the file record itself is changed, such as by moving the file, renaming it, or changing its permissions. Unlike the 'Modified' timestamp, which tracks file content changes, the MFT change timestamp is exclusively tied to the record metadata. This makes it a unique indicator for tracking structural changes to a file that may be missed if looking only at content modification times.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is updated whenever the file's content changes.
Why it's wrong here
Content changes trigger an update to the 'Modified' timestamp within the SI attribute. The 'MFT Change' timestamp is specifically reserved for changes to the MFT entry itself, such as permission updates or renaming, and does not reflect edits made to the internal data of the file.
- ✓
It tracks when the file metadata was last modified.
Why this is correct
The MFT Change timestamp reflects the last time the file's MFT record metadata was modified. This includes operations like renaming, changing permissions, or moving the file. It is a distinct temporal artifact from the file content modification time and provides critical context for structural changes to the file system.
- ✗
It is easily modified by standard user applications.
Why it's wrong here
While SI attributes are easily spoofed, the MFT Change timestamp is harder to manipulate because it is tied to the internal management of the MFT record. It is less commonly targeted by standard timestomping tools, making it a relatively more reliable indicator of when file record activity actually took place.
- ✗
It is identical to the file's creation time.
Why it's wrong here
The MFT Change timestamp is updated whenever metadata changes, while the creation time is set at the file's birth. While they might be identical initially, they diverge over the file's life as metadata modifications occur. They are distinct timestamps serving different purposes in the forensic analysis of a file.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.