A forensic examiner is analyzing a Windows system image and wants to identify all files that were accessed during a specific time window when sensitive documents were exfiltrated. The examiner has already created a timeline using $MFT and $LogFile data. Which analysis technique would be most effective for this task?

Sort the timeline by file size and look for large files that were recently created.

Search the timeline for files with modification timestamps in the window, as these are more reliable than access times.

Export the timeline to a spreadsheet and manually review all entries for the day of the incident.

Filter the timeline to show only entries with access timestamps within the window and correlate them with user login times.

An analyst is reviewing a timeline and notices that a file's creation time is earlier than the installation time of the operating system on the same volume. What is the most likely explanation for this discrepancy?

The file was created by a malicious program that deliberately set a false creation time.

The file was restored from a backup or copied from another system, preserving its original creation timestamp.

The file system clock was incorrect at the time of creation, leading to a false timestamp.

The timeline tool incorrectly parsed the timestamp due to a bug.

During a timeline analysis, an analyst notices a series of files in a user's profile directory that were created in rapid succession during off-hours, followed by a mass deletion event. The analyst also sees that the user's account was used to log in at the same time. What is the most reasonable interpretation of this timeline pattern?

The user was likely performing a legitimate bulk file operation, such as installing software or syncing files.

The file system experienced corruption, causing incorrect timestamps and phantom file entries.

An automated process or script may have created and then deleted files, possibly to cover tracks or perform a cleanup task.

The timeline is unreliable because file creation times are not trustworthy on modern file systems.

A forensic analyst is creating a timeline from a Windows 10 system image. The analyst wants to include file system metadata from the NTFS $MFT, $LogFile, and $UsnJrnl. Which tool or method is best suited to parse these data sources and generate a timeline?

Use 'dd' to copy the MFT and $LogFile to separate files and analyze them with a hex editor.

Use the Windows 'fsutil' command to query file system information and export it to a CSV file.

Use the Sleuth Kit's 'fls' and 'ils' commands to extract metadata and then process the output with 'mactime'.

Use 'grep' to search the raw image for file names and timestamps.

Which of the following is a common data source used to create a file system timeline?

File system metadata such as MAC times from NTFS or ext4

Network packet captures from a firewall

System event logs from the Windows Event Viewer

GIAC Certified Forensic Analyst

Domain 3Objective 1

Introduction to File System Timeline Forensics GCFA Practice Questions (Page 7)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 31–35

31application · medium
A forensic examiner is analyzing a Windows system image and wants to identify all files that were accessed during a specific time window when sensitive documents were exfiltrated. The examiner has already created a timeline using $MFT and $LogFile data. Which analysis technique would be most effective for this task?
Select an answer first
32application · medium
An analyst is reviewing a timeline and notices that a file's creation time is earlier than the installation time of the operating system on the same volume. What is the most likely explanation for this discrepancy?
Select an answer first
33application · medium
During a timeline analysis, an analyst notices a series of files in a user's profile directory that were created in rapid succession during off-hours, followed by a mass deletion event. The analyst also sees that the user's account was used to log in at the same time. What is the most reasonable interpretation of this timeline pattern?
Select an answer first
34application · medium
A forensic analyst is creating a timeline from a Windows 10 system image. The analyst wants to include file system metadata from the NTFS $MFT, $LogFile, and $UsnJrnl. Which tool or method is best suited to parse these data sources and generate a timeline?
Select an answer first
35foundation · easy
Which of the following is a common data source used to create a file system timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Introduction to File System Timeline Forensics GCFA Practice Questions (Page 7)

Questions 31–35

An analyst is reviewing a timeline and notices that a file's creation time is earlier than the installation time of the operating system on the same volume. What is the most likely explanation for this discrepancy?

A forensic analyst is creating a timeline from a Windows 10 system image. The analyst wants to include file system metadata from the NTFS $MFT, $LogFile, and $UsnJrnl. Which tool or method is best suited to parse these data sources and generate a timeline?

Which of the following is a common data source used to create a file system timeline?

Keep studying — File System Forensics