Introduction to File System Timeline Forensics GCFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is correlating a file system timeline with Windows Event Logs. The timeline shows that a file was modified at 3:00 PM, and the event log shows a successful logon for the user 'jsmith' at 2:59 PM from a workstation in the same office. What additional evidence would most strongly support the conclusion that jsmith modified the file?

   • AThe event log shows that jsmith's account was used to access the file share where the file resides.
   • BThe file is located in jsmith's home directory.
   • CThe file's extension is .docx, which is commonly used by jsmith.
   • DThe file's modification time is within one minute of the logon time.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst is investigating a Windows system where the user claims they did not access a particular confidential file. The timeline shows that the file's last access time was updated, but the user's login times do not overlap with that access time. The analyst also finds that an antivirus scan ran at the same time. What is the most likely explanation for the access time update?

   • AThe antivirus scan accessed the file, updating its last access time without user interaction.
   • BThe timeline is unreliable because access times are not updated on NTFS by default.
   • CThe file system has a bug that incorrectly updates access times.
   • DThe user accessed the file remotely, and the login times are not captured in the timeline.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are analyzing a timeline from a Linux server that was compromised. The timeline shows a file in /var/www/html was created at 2:00 AM, and the web server access log shows a POST request to that file at 2:01 AM. The server's system clock is known to be 5 minutes fast. The web server log timestamps are in UTC. Which time should you use for correlating the file creation with the web request?

   • AConvert the web log timestamp to local time and compare directly.
   • BUse the file system timestamp as-is because it is in local time.
   • CIgnore the clock skew because both timestamps are from the same system.
   • DAdjust the file system timestamp by subtracting 5 minutes, then compare with the web log timestamp.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   In a timeline from a Windows system, you see a file that was created, then modified, and then the file's last access time was updated repeatedly over several days. The file is a DLL in the System32 folder. Which hypothesis is most plausible?

   • AThe file was modified by an attacker and then accessed repeatedly to hide the modification.
   • BThe file's timestamps were manually changed by the user.
   • CThe file was deleted and recreated multiple times.
   • DThe repeated access time updates are likely due to normal system processes loading the DLL, not user activity.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is reviewing a timeline and sees that a file was created, then modified, and then deleted, all within a five-minute window. The analyst also sees that a user logged in at the start of the window and logged off at the end. What is the most likely interpretation?

   • AAn automated process created, modified, and deleted the file, and the user login was coincidental.
   • BThe timeline is unreliable because such rapid activity is impossible for a human user.
   • CThe user created, edited, and then deleted the file during a brief session, possibly to hide their activity.
   • DThe file system is corrupted, causing false timestamps and phantom entries.
   Reveal Solution Discussion Select an answer first