An investigator needs to create a timeline of file system activity from a raw disk image of a Windows system. The image contains an NTFS volume. Which tool or method is most appropriate for this task?

Use 'fls' to list files and 'mactime' to generate a timeline from the body file.

Use 'dd' to create a copy of the disk and then open it in a hex editor.

Use 'grep' to search for date patterns in the raw image.

Use 'strings' to extract text from the disk image and manually sort timestamps.

An analyst is building a timeline for a Linux system and needs to include file system timestamps, bash history, and auth.log entries. The analyst wants to correlate user commands with file modifications. What is the most effective approach?

Use the 'last' command to view login history and correlate it with file timestamps.

Manually review each source and create a separate timeline for each.

Use the 'stat' command on each file to get timestamps and compare them with bash history.

Create a super timeline using plaso, which can parse all these sources and output a unified timeline.

An analyst is building a timeline for a Windows system and wants to include data from the USN journal, event logs, and file system metadata. The analyst needs to ensure that the timeline is comprehensive and can be used to correlate events across these sources. What is the best approach?

Use plaso to parse all sources and create a super timeline.

Manually review each source and create a separate timeline for each.

Use the 'wevtutil' command to export event logs and compare them with file timestamps.

Use the 'fls' and 'mactime' tools to create a timeline from file system metadata only.

GIAC Certified Forensic Analyst

Domain 3Objective 2

File System Timeline Artifact Analysis GCFA Practice Questions (Page 2)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

5concepts

Questions 6–10

6application · medium
An investigator needs to create a timeline of file system activity from a raw disk image of a Windows system. The image contains an NTFS volume. Which tool or method is most appropriate for this task?
Select an answer first
7application · medium
An investigator is creating a timeline from a Windows system and wants to include timestamps from the USN journal. Which tool is most appropriate for extracting this data?
Select an answer first
8expert · hard
An analyst is building a timeline for a Linux system and needs to include file system timestamps, bash history, and auth.log entries. The analyst wants to correlate user commands with file modifications. What is the most effective approach?
Select an answer first
9expert · hard
An analyst is building a timeline for a Windows system and wants to include data from the USN journal, event logs, and file system metadata. The analyst needs to ensure that the timeline is comprehensive and can be used to correlate events across these sources. What is the best approach?
Select an answer first
10application · medium
An investigator is building a timeline from a Linux system and wants to include file access, modification, and change times. Which command-line tool is most appropriate for extracting these timestamps from the file system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

File System Timeline Artifact Analysis GCFA Practice Questions (Page 2)

Questions 6–10

An investigator needs to create a timeline of file system activity from a raw disk image of a Windows system. The image contains an NTFS volume. Which tool or method is most appropriate for this task?

An investigator is creating a timeline from a Windows system and wants to include timestamps from the USN journal. Which tool is most appropriate for extracting this data?

An analyst is building a timeline for a Linux system and needs to include file system timestamps, bash history, and auth.log entries. The analyst wants to correlate user commands with file modifications. What is the most effective approach?

An analyst is building a timeline for a Windows system and wants to include data from the USN journal, event logs, and file system metadata. The analyst needs to ensure that the timeline is comprehensive and can be used to correlate events across these sources. What is the best approach?

An investigator is building a timeline from a Linux system and wants to include file access, modification, and change times. Which command-line tool is most appropriate for extracting these timestamps from the file system?

Keep studying — File System Forensics