A forensic analyst is examining an NTFS volume and needs to determine when a specific file was last accessed. The analyst finds that the $STANDARD_INFORMATION last access time is 2024-05-01 10:00:00 UTC, but the $FILE_NAME last access time is 2024-04-28 09:00:00 UTC. The system has 'last access time update' disabled. Which timestamp should the analyst report as the most reliable last access time?

The $FILE_NAME time, because it is more stable and less likely to be modified by applications.

Neither timestamp is reliable for determining last access because the feature is disabled.

The $STANDARD_INFORMATION time, because it is updated by the NTFS driver on every read.

Both timestamps, noting that the discrepancy indicates the file was accessed between the two dates.

An examiner is working with a large timeline and needs to identify files that were accessed during a specific 15-minute window. The timeline contains millions of entries. Which technique is most efficient for this task?

Manually scroll through the timeline in a text editor.

Sort the timeline by file name and look for files accessed during the window.

Use a database query to filter entries by timestamp range.

Use 'grep' to search for the time range in the raw timeline file.

What is the primary purpose of constructing a file system timeline during a forensic investigation?

To establish a chronological sequence of file system activity that can be correlated with other evidence

To verify the integrity of the file system by comparing hash values of all files

To identify the owner of each file by examining security identifiers

To recover deleted files by analyzing the unallocated space of the disk

During a forensic examination, an analyst needs to build a comprehensive timeline of file system activity. Which approach best describes the process of timeline creation?

Extracting only the last access time from each file to determine when the system was last used

Collecting timestamps from file system metadata, system logs, and application artifacts, then merging them into a single chronological view

Running a keyword search across all files to identify relevant evidence and then sorting results by file size

Copying all file metadata into a spreadsheet and manually reviewing each entry for anomalies

An analyst has a large timeline of file system events and wants to focus on events that occurred during a specific two-hour window on a particular day. Which technique is most appropriate?

Sorting the timeline by file size

Visualizing the timeline as a pie chart

Filtering the timeline by date and time range

Grouping the timeline by file extension

GIAC Certified Forensic Analyst

Domain 3Objective 2

File System Timeline Artifact Analysis GCFA Practice Questions (Page 4)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

5concepts

Questions 16–20

16application · medium
A forensic analyst is examining an NTFS volume and needs to determine when a specific file was last accessed. The analyst finds that the $STANDARD_INFORMATION last access time is 2024-05-01 10:00:00 UTC, but the $FILE_NAME last access time is 2024-04-28 09:00:00 UTC. The system has 'last access time update' disabled. Which timestamp should the analyst report as the most reliable last access time?
Select an answer first
17application · medium
An examiner is working with a large timeline and needs to identify files that were accessed during a specific 15-minute window. The timeline contains millions of entries. Which technique is most efficient for this task?
Select an answer first
18foundation · easy
What is the primary purpose of constructing a file system timeline during a forensic investigation?
Select an answer first
19foundation · easy
During a forensic examination, an analyst needs to build a comprehensive timeline of file system activity. Which approach best describes the process of timeline creation?
Select an answer first
20foundation · easy
An analyst has a large timeline of file system events and wants to focus on events that occurred during a specific two-hour window on a particular day. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.