File System Timeline Artifact Analysis GCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is reviewing a timeline and wants to identify all files that were modified during a specific 15-minute window. The timeline contains millions of entries. Which technique is most efficient for this task?

   • AUse a timeline tool to filter by the modification timestamp range.
   • BSort the timeline by file size and focus on the largest files.
   • CManually scroll through the timeline and note any files that appear relevant.
   • DSearch for files with specific extensions, such as .exe or .dll.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst is investigating a malware infection. The file system timeline shows that a file 'svchost.exe' was created in the 'C:\Windows\System32' directory at 03:00:00 UTC. The Security event log shows a service installation event at 03:00:05 UTC. The file's $STANDARD_INFORMATION creation time is 03:00:00 UTC, and its modification time is 03:00:10 UTC. The analyst also finds that the file's digital signature is invalid. Which conclusion is best supported?

   • AThe file is malware that was placed in System32 and registered as a service.
   • BThe file is a false positive and should be ignored.
   • CThe file is a legitimate system file that was updated by a Windows update.
   • DThe file is a legitimate file that was modified by an administrator.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is building a timeline from a Windows 10 system image. The user's Documents folder contains a file that was created on Monday, but the $STANDARD_INFORMATION (SI) creation timestamp shows Sunday. The $FILE_NAME (FN) creation timestamp shows Monday. The analyst needs to determine which timestamp reflects the actual file creation for the investigation. What should the analyst do?

   • AIgnore both timestamps and rely on the file's last modified time from the NTFS change journal.
   • BAverage the two timestamps to estimate the true creation time.
   • CUse the FN creation timestamp (Monday) as the creation time because it is updated less frequently and reflects the original file name entry.
   • DUse the SI creation timestamp (Sunday) as the authoritative creation time because it is the primary metadata attribute.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In NTFS, which metadata attribute contains the MAC times that are most commonly modified by the operating system when a file is accessed or changed?

   • A$STANDARD_INFORMATION
   • B$FILE_NAME
   • C$DATA
   • D$SECURITY_DESCRIPTOR
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is examining a timeline of file system activity from a compromised Linux server. The timeline contains thousands of entries, and the analyst needs to identify files that were modified during the suspected breach window (02:00–03:00 UTC). Which technique is most effective for isolating relevant entries?

   • ASort the timeline by file size and focus on the largest files.
   • BGroup the timeline by user ID and focus on the root user's activities.
   • CSearch for files with the .tmp extension, as these are commonly used by attackers.
   • DFilter the timeline to show only entries with modification timestamps between 02:00 and 03:00 UTC.
   Reveal Solution Discussion Select an answer first