Introduction to File System Timeline Forensics GCFA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are building a timeline from a forensic image of a Windows system that uses the exFAT file system on a USB drive. Which consideration is most important when interpreting the timeline?

   • AexFAT uses a journal that must be parsed to get accurate timestamps.
   • BexFAT timestamps are stored in UTC, so no timezone conversion is needed.
   • CexFAT does not provide the same level of metadata (e.g., no creation time in some implementations) as NTFS, so the timeline may have gaps.
   • DexFAT does not support file deletion, so the timeline will only contain active files.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which timeline analysis technique is used to identify unusual file activity that may indicate malicious behavior?

   • ALooking for files with timestamps that fall outside normal user activity hours
   • BCounting the total number of files on the system
   • CChecking the file system for bad sectors
   • DSorting files alphabetically by name
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An analyst is investigating a case where an insider is suspected of deleting critical files. The timeline shows that the files were deleted at 10:00 PM, and the user's account was logged off at 10:05 PM. However, the analyst also finds that a scheduled backup ran at 9:55 PM and completed at 10:10 PM. Which conclusion is most defensible?

   • AThe deletion occurred after the backup completed, so the files are not in the backup.
   • BThe deletion was performed by the backup process, not the user.
   • CThe timeline is contradictory, and the deletion time cannot be determined.
   • DThe deletion occurred before the backup completed, so the files may be recoverable from the backup.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is correlating a file system timeline with security logs from a compromised server. The timeline shows a file named 'update.exe' was created in the system32 directory at 02:15 AM. The security logs show a successful logon for a service account at 02:14 AM from an unusual IP address. What additional evidence would most strongly support the conclusion that the file was placed by an attacker?

   • AThe file has the same name as a legitimate Windows executable.
   • BThe file was created in the system32 directory, which is a protected location.
   • CThe file's digital signature is invalid and its hash matches a known malware sample.
   • DThe file's creation time is within a few minutes of the logon event.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic examiner is asked to determine the order of events leading to the deletion of a critical database file on a Windows server. The server's system clock was later found to be 30 minutes behind UTC. What is the most appropriate first step?

   • AIgnore the clock skew because file system timestamps are stored in UTC.
   • BEstablish a time offset and apply it consistently to all timeline entries before correlating with other logs.
   • CAdjust only the timestamps of the database file, not the rest of the timeline.
   • DOnly use the file system timestamps and disregard other logs.
   Reveal Solution Discussion Select an answer first