An analyst is examining a timeline and finds that a file's last access time is earlier than its creation time. This is an anomaly that could indicate what?

The file was accessed before it was created, which is impossible, indicating timestamp manipulation or a file system bug.

The timeline tool incorrectly parsed the timestamps due to a time zone conversion error.

The file was created on a different file system and then copied, preserving the original access time.

The file system clock was set back during the file's lifetime, causing the access time to be earlier.

You are analyzing a timeline from a compromised Linux server. You see a file in /tmp that was created, modified, and accessed within a one-minute window, and then the file's access time was updated several times over the next hour. No user was logged in during that period. Which analysis step is most likely to reveal the cause?

Examine the file's extended attributes for a checksum.

Look for the file in the system's locate database to see if it was indexed.

Check the file's ownership and permissions to see if it is writable by the web server user.

Correlate the timeline with process execution logs (e.g., auditd or sysmon) to identify which process accessed the file.

What is the primary purpose of file system timeline forensics in a digital investigation?

To determine the physical location of a file on the hard drive

To recover deleted files from unallocated disk space

To identify the owner of a file by analyzing access control lists

To reconstruct a sequence of file-related events based on timestamps and metadata

When analyzing a file system timeline, what does a cluster of file modification times in a short window typically indicate?

A batch operation such as an installer or script modified many files at once

A user manually edited each file individually

A forensic examiner is working on a case involving a Linux server that uses the ext4 file system. The examiner needs to create a timeline that includes file metadata, directory entries, and journal data. The examiner has limited time and must choose a tool that can efficiently parse these sources. Which tool is best suited for this task?

The Sleuth Kit's 'fls' and 'ils' commands, combined with 'mactime'.

The 'debugfs' command, which allows low-level file system debugging and can dump inode information.

The 'extundelete' tool, which can recover deleted files and their metadata.

The 'e2fsck' command, which checks and repairs ext4 file systems.

GIAC Certified Forensic Analyst

Domain 3Objective 1

Introduction to File System Timeline Forensics GCFA Practice Questions (Page 5)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 21–25

21expert · hard
An analyst is examining a timeline and finds that a file's last access time is earlier than its creation time. This is an anomaly that could indicate what?
Select an answer first
22application · medium
You are analyzing a timeline from a compromised Linux server. You see a file in /tmp that was created, modified, and accessed within a one-minute window, and then the file's access time was updated several times over the next hour. No user was logged in during that period. Which analysis step is most likely to reveal the cause?
Select an answer first
23foundation · easy
What is the primary purpose of file system timeline forensics in a digital investigation?
Select an answer first
24foundation · easy
When analyzing a file system timeline, what does a cluster of file modification times in a short window typically indicate?
Select an answer first
25expert · hard
A forensic examiner is working on a case involving a Linux server that uses the ext4 file system. The examiner needs to create a timeline that includes file metadata, directory entries, and journal data. The examiner has limited time and must choose a tool that can efficiently parse these sources. Which tool is best suited for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Introduction to File System Timeline Forensics GCFA Practice Questions (Page 5)

Questions 21–25

An analyst is examining a timeline and finds that a file's last access time is earlier than its creation time. This is an anomaly that could indicate what?

What is the primary purpose of file system timeline forensics in a digital investigation?

When analyzing a file system timeline, what does a cluster of file modification times in a short window typically indicate?

Keep studying — File System Forensics