GCFA Practice Question: Introduction to File System Timeline Forensics
Which of these is the primary limitation of using a file system 'Birth' time as a definitive event marker?
⚠ Common exam trap
Candidates incorrectly assume 'Birth' time is an immutable record of when a file was first created, forgetting that copy operations frequently generate a new 'Birth' timestamp for the destination file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It is reset during file move or copy operations
The 'Birth' time is highly vulnerable to being reset or changed during common file operations, such as moving or copying files to a new location or restoring from a backup. Because it does not represent the original, immutable creation of the file in the environment, it cannot be reliably used as a 'ground truth' for when an attacker first introduced the file to the system. Investigators must corroborate this with other evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It is not recorded in the MFT for small files
Why it's wrong here
The MFT records birth time for all files regardless of their size. There is no such limitation in the NTFS architecture for small files; all MFT entries contain this attribute by design. Therefore, the file size is irrelevant to the availability of the creation timestamp in the file system metadata.
- ✓
It is reset during file move or copy operations
Why this is correct
Moving or copying a file creates a new entry in the file system, which results in a new birth timestamp. This destroys the original creation evidence, making the birth time useless for determining when the file first arrived on the system if it has been moved or copied by the attacker.
- ✗
It is only available on newer versions of Windows
Why it's wrong here
The creation timestamp (birth time) has been a core component of NTFS since its inception. It is not a feature restricted to newer versions of Windows. Any version of Windows that supports NTFS, which is nearly all since the early 90s, maintains this timestamp in the MFT entry for every file.
- ✗
It is protected from being read by forensic tools
Why it's wrong here
Birth times are fully accessible to forensic tools that parse the MFT. There is no protection mechanism that hides this data from an investigator with physical access to the drive. The issue is not availability, but the fact that the value itself is frequently modified by standard operating system file management tasks.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.