Introduction to File System Timeline Forensics GCFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is creating a timeline from a Linux system image to investigate unauthorized access. The system uses the ext4 file system. The analyst wants to include file metadata, directory entries, and journal data in the timeline. Which set of tools and data sources should be used?

   • AUse 'mmls' to display the partition layout and 'fsstat' to show file system statistics, then manually record timestamps.
   • BUse 'grep' to search raw disk blocks for timestamps and compile them into a timeline.
   • CUse 'dstat' to monitor live file system activity and generate a timeline from the output.
   • DUse 'fls' to list file names and metadata, 'ils' to recover inode information, and 'icat' to extract file contents from the image.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   Your timeline shows that a confidential PDF was modified at 3:15 PM. The user's email client shows an outbound message with that PDF attached at 3:20 PM. The user claims they never opened the file. Which interpretation is most defensible?

   • AThe modification time proves the user edited the PDF, and the email confirms they sent it.
   • BThe modification time may have been updated by an automated process, and the email attachment could have been added without the user opening the PDF.
   • CThe file system timestamp is authoritative, so the user's claim is false.
   • DThe email timestamp is more reliable than the file system timestamp, so the user must have opened the file.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   You are building a timeline for a Windows system that uses BitLocker. The system was imaged while powered off, and you have the recovery key. You need to include file system metadata from the encrypted volume. Which approach is correct?

   • AParse the file system metadata directly from the encrypted image because BitLocker only encrypts file contents, not metadata.
   • BDecrypt the volume using the recovery key to obtain a logical image, then parse the file system metadata from the decrypted image.
   • COnly parse the unencrypted system partition and ignore the encrypted data volume.
   • DUse the memory dump to extract the BitLocker keys and then parse the encrypted image without decryption.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an investigation, you build a timeline that shows a user's document was created at 10:00 AM, but the user's alibi places them in a meeting from 9:00 to 11:00 AM. You also find that the user's workstation was remotely accessed via RDP at 9:45 AM. Which interpretation is most consistent with the evidence?

   • AThe RDP session is unrelated because RDP does not allow file creation.
   • BThe file creation time is wrong because the user was in a meeting.
   • CThe file may have been created by a remote session, so the timeline should be correlated with RDP logon events to confirm.
   • DThe user must have created the file before the meeting and the timestamp is inaccurate.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic analyst is building a timeline for a case involving a Linux server. The analyst wants to include file system metadata from the ext4 journal, inodes, and directory entries. Which of the following best describes the primary purpose of including the journal in the timeline?

   • ATo identify file system transactions that may not be reflected in the current metadata, such as deleted files or incomplete operations.
   • BTo provide a complete list of all files on the file system, including those that have been deleted.
   • CTo determine the exact time the file system was last mounted.
   • DTo verify the integrity of the file system and ensure that the timeline is accurate.
   Reveal Solution Discussion Select an answer first