An analyst is constructing a timeline for a Windows system and wants to include events from the NTFS change journal, Windows event logs, and file system metadata. What is the best approach to aggregate these diverse sources into a single timeline?

Only use file system metadata and ignore logs, as they are less reliable.

Convert all timestamps to UTC and sort them in a spreadsheet without considering the source.

Create separate timelines for each source and manually compare them side by side.

Use a tool like plaso (log2timeline) to parse all sources and output a single super timeline.

During a timeline review, an analyst notices that a critical system file has a modification time that is several months after the system's last patch date. What is the most significant forensic implication?

The file was simply accessed by a user and the modification time is irrelevant

The file was automatically updated by the operating system without logging

The file may have been altered by an unauthorized party or malicious activity

The modification time is a false positive and can be ignored

During an incident response, an analyst is correlating a file system timeline with Windows Event Logs. The timeline shows that a file named 'update_installer.exe' was created in the Downloads folder at 14:32:10 UTC. The Security event log shows a successful logon for user 'jsmith' at 14:31:55 UTC. The System event log shows the 'Microsoft-Windows-Bits-Client' service started at 14:32:05 UTC. The file's $STANDARD_INFORMATION modification time is 14:32:12 UTC. Which conclusion is best supported by this correlation?

The file was created by an attacker who compromised 'jsmith's account.

The file was downloaded by user 'jsmith' using a web browser.

The file was likely created by a background process using BITS, possibly without direct user interaction.

The file was created by the operating system during a scheduled update.

Which visualization is most effective for identifying clusters of file system activity over time in a timeline analysis?

A line graph of disk space usage over time

A scatter plot of file sizes versus modification times

A bar chart showing the number of events per hour

A pie chart showing the proportion of file types

GIAC Certified Forensic Analyst

Domain 3Objective 2

File System Timeline Artifact Analysis GCFA Practice Questions (Page 5)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

5concepts

Questions 21–25

21application · medium
An analyst is constructing a timeline for a Windows system and wants to include events from the NTFS change journal, Windows event logs, and file system metadata. What is the best approach to aggregate these diverse sources into a single timeline?
Select an answer first
22foundation · easy
When correlating file system timestamps with other artifacts, which artifact would best help confirm that a file was downloaded from the internet at a specific time?
Select an answer first
23foundation · easy
During a timeline review, an analyst notices that a critical system file has a modification time that is several months after the system's last patch date. What is the most significant forensic implication?
Select an answer first
24application · medium
During an incident response, an analyst is correlating a file system timeline with Windows Event Logs. The timeline shows that a file named 'update_installer.exe' was created in the Downloads folder at 14:32:10 UTC. The Security event log shows a successful logon for user 'jsmith' at 14:31:55 UTC. The System event log shows the 'Microsoft-Windows-Bits-Client' service started at 14:32:05 UTC. The file's $STANDARD_INFORMATION modification time is 14:32:12 UTC. Which conclusion is best supported by this correlation?
Select an answer first
25foundation · easy
Which visualization is most effective for identifying clusters of file system activity over time in a timeline analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

File System Timeline Artifact Analysis GCFA Practice Questions (Page 5)

Questions 21–25

An analyst is constructing a timeline for a Windows system and wants to include events from the NTFS change journal, Windows event logs, and file system metadata. What is the best approach to aggregate these diverse sources into a single timeline?

When correlating file system timestamps with other artifacts, which artifact would best help confirm that a file was downloaded from the internet at a specific time?

During a timeline review, an analyst notices that a critical system file has a modification time that is several months after the system's last patch date. What is the most significant forensic implication?

Which visualization is most effective for identifying clusters of file system activity over time in a timeline analysis?

Keep studying — File System Forensics