File System Timeline Artifact Analysis GCFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An investigator is building a timeline from a Windows 10 system image. The $STANDARD_INFORMATION (SI) timestamps for a suspicious executable show a creation time of 2024-03-10 08:15:22 UTC, but the $FILE_NAME (FN) timestamps show a creation time of 2024-03-10 08:15:25 UTC. The investigator also notices the SI modification time is 2024-03-11 14:02:11 UTC while the FN modification time is 2024-03-10 08:15:25 UTC. Which action should the investigator take to avoid a false conclusion about when the file was first created on the system?

   • AReport both timestamps and note the discrepancy, then correlate with other artifacts like the $LogFile or USN journal to determine the most likely true creation event.
   • BTreat the SI creation time as the true creation time and ignore the FN timestamps entirely.
   • CUse the earliest timestamp (SI creation) as the definitive creation time because timestamps can only be moved forward, not backward.
   • DUse the FN creation time as the authoritative creation time because it is updated less frequently by applications.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is examining an NTFS volume and needs to determine the original creation time of a file that was copied from another location. The file's $STANDARD_INFORMATION creation time is 2024-07-01 10:00:00 UTC, and the $FILE_NAME creation time is 2024-07-01 10:00:00 UTC. However, the analyst knows the file was copied from a USB drive. Which timestamp is most likely to reflect the original creation time on the source system?

   • AThe $STANDARD_INFORMATION creation time, because it is preserved during copy operations.
   • BNeither timestamp reflects the original creation time because copy operations reset creation times.
   • CThe $FILE_NAME creation time, because it is preserved during copy operations.
   • DThe modification time, because it is preserved during copy operations.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic analyst is examining a file on an NTFS volume and notices that the $STANDARD_INFORMATION (SI) timestamps have been cleared (set to 0), but the $FILE_NAME (FN) timestamps are intact. What is the most likely explanation?

   • AAn attacker used a tool like timestomp to clear the SI timestamps, but the FN timestamps were not modified.
   • BThe file system was corrupted, causing the SI timestamps to be lost.
   • CThe file was copied from a different file system, which does not support SI timestamps.
   • DThe file was deleted and then recovered, which cleared the SI timestamps.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst is correlating file system events with system logs. Which type of log is most likely to provide evidence of a user executing a program that was recently created on the system?

   • ASetup event log (e.g., Windows installation)
   • BSystem event log (e.g., Windows Event ID 6005)
   • CSecurity event log (e.g., Windows Event ID 4688)
   • DApplication event log (e.g., error reports)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is using a timeline analysis tool to review a large dataset from a compromised system. The analyst wants to focus on files that were modified in the /etc directory on a Linux system during a specific time range. Which filtering and sorting strategy is most effective?

   • ASort by modification time and manually scroll through the entire timeline.
   • BFilter by file type and sort by file size.
   • CFilter by file path containing '/etc' and sort by modification time.
   • DFilter by user ID and sort by access time.
   Reveal Solution Discussion Select an answer first