Introduction to File System Timeline Forensics GCFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner is preparing to create a timeline from a Windows 10 image. The examiner wants to include data from the $MFT, $LogFile, and $UsnJrnl. Which of the following best describes the order of operations for creating the timeline?

   • AParse the $MFT first, then the $LogFile, and finally the $UsnJrnl, and present the results in separate timelines.
   • BExtract metadata from each source, normalize the timestamps, merge the data, and then sort by time.
   • CCopy the raw data from each source to a separate file and then manually align the timestamps.
   • DUse a single tool to parse all three sources simultaneously and output a single timeline file.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You are investigating a case where a user is accused of deleting evidence. The timeline shows a file was deleted at 3:00 PM. The user's system has Volume Shadow Copies enabled. You also have a network share that was backed up at 2:00 PM. Which source would most likely provide a copy of the file before deletion?

   • AOnly the network backup, because Volume Shadow Copies are deleted when a file is deleted.
   • BNeither source, because the file was deleted and cannot be recovered.
   • CThe Volume Shadow Copy from before 3:00 PM, if available, and the network backup from 2:00 PM.
   • DOnly the Volume Shadow Copy, because the network backup is not a forensic source.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are creating a timeline from a forensic image of a Windows 10 system. The image includes unallocated space. Which step is essential to ensure the timeline includes metadata from files that were deleted but may be recoverable?

   • ADisable the parsing of $MFT because it only contains active files.
   • BOnly parse the $LogFile because it contains records of all file operations.
   • CParse the $MFT and also scan unallocated space for $MFT entries that are no longer in use.
   • DRun a file carving tool to recover file contents from unallocated space.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is it important to correlate file system timeline entries with other evidence, such as system logs?

   • ATo provide context and validate the sequence of events
   • BTo confirm that the file system is intact
   • CTo reduce the size of the timeline file
   • DTo automatically generate a final report
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are examining a Windows 10 system that was imaged after a suspected malware infection. The malware is known to delete its own executable after execution. You have built a timeline from the $MFT, but you notice that the executable's $MFT entry is missing from the active $MFT. You also have a memory dump from the live system. Which approach would most likely recover the executable's metadata for the timeline?

   • AScan unallocated space for the $MFT entry and also parse the $LogFile and $UsnJrnl for records referencing the file.
   • BRebuild the timeline using only the $LogFile because it contains all file operations.
   • CUse the memory dump to extract the executable's content and then hash it to identify it.
   • DConclude that the file never existed because its $MFT entry is gone.
   Reveal Solution Discussion Select an answer first