Introduction to File System Timeline Forensics GCFA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A senior forensic analyst is leading an investigation of a data breach at a financial institution. The analyst has a forensic image of a Windows server and needs to build a timeline that covers a period of six months. The analyst must balance the need for comprehensive data with the time available for analysis. Which approach best balances completeness and efficiency?

   • ACreate a timeline from the MFT only, as it contains all necessary timestamps for every file.
   • BUse only the $LogFile, as it provides the most detailed record of file system transactions.
   • CRely solely on the $UsnJrnl, as it contains a complete record of all file changes over the six-month period.
   • DParse the $MFT and $LogFile to create a baseline timeline, then supplement with $UsnJrnl and selected event logs for the incident window.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is investigating a case where an employee is suspected of stealing proprietary data. The timeline shows that a file named 'customers.xlsx' was accessed at 3:00 PM, and a USB device was connected at 3:05 PM. The analyst also finds that the employee's email account sent an attachment at 3:10 PM. Which conclusion is best supported by this evidence?

   • AThe timeline is inconclusive because file access times are not reliable.
   • BThe employee definitely exfiltrated the data via USB and email.
   • CThe employee only used the USB device to transfer the file, and the email was unrelated.
   • DThe employee likely copied the file to the USB device and then emailed it.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are analyzing a timeline from a Windows system where a user is suspected of copying files to a USB drive. The timeline shows a large number of files were accessed in a short period. The USB drive was not imaged. Which additional evidence would most strongly support the hypothesis that files were copied to the USB drive?

   • AThe file system timeline shows the files were accessed, which is sufficient to prove copying.
   • BWindows event logs showing the USB device was connected at the same time as the file access, and the presence of a setupapi.dev.log entry for the device.
   • CThe user's browser history showing they searched for 'how to copy files'.
   • DThe presence of a shortcut (.lnk) file to the USB drive on the desktop.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following best describes the value of timeline forensics over simply listing file metadata?

   • AIt automatically identifies malware based on file signatures
   • BIt guarantees the integrity of the original evidence
   • CIt provides a chronological view that helps correlate file activity with other events in the investigation
   • DIt eliminates the need for manual review of file system data
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic analyst is investigating a suspected data exfiltration incident on a Windows 10 workstation. The analyst has a full disk image and needs to determine when a specific USB drive was first connected and which files were accessed from it. The analyst plans to build a timeline from file system metadata. Which approach will most effectively support this investigation?

   • AParse the NTFS $MFT and $LogFile to extract file creation, modification, and access times, then correlate USB device artifacts with file access timestamps.
   • BReview the Windows Event Logs for USB device installation events and match them with file creation times.
   • CRecover deleted files from unallocated space and examine their metadata for timestamps.
   • DAnalyze the Windows Prefetch files to identify recently executed programs and map them to user activity.
   Reveal Solution Discussion Select an answer first