Introduction to File System Timeline Forensics GCFA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   You are investigating a case where a user allegedly stole a confidential spreadsheet. The user's workstation shows the spreadsheet was created at 9:00 AM, and the user's email shows an outbound message with the spreadsheet attached at 9:05 AM. However, the user claims they never opened the file. You also find that the spreadsheet's 'last printed' metadata shows a print job at 8:55 AM. Which conclusion is most defensible?

   • AThe print metadata suggests the file was accessed before the email, but the user could have printed it without opening it, so the evidence is inconclusive.
   • BThe file creation time is more reliable than the print metadata, so the user must have opened it after creation.
   • CThe print metadata proves the user opened the file because printing requires opening it.
   • DThe email attachment proves the user sent the file, so they must have opened it.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You are building a timeline for a Linux server that hosted a web application. The investigation concerns a possible web shell upload. Which combination of data sources would provide the most complete file system timeline for correlating file creation with web server activity?

   • AThe /var/log/auth.log and the package manager logs.
   • BThe bash history of all users and the system syslog.
   • CThe output of the 'last' command and the process accounting logs.
   • DExt4 journal and inode metadata, plus the web server access and error logs.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   While analyzing a timeline from a Windows system, you notice that a user's document was modified at 11:30 AM, but the user was logged off at 11:00 AM. The system's event logs show a service account logged on at 11:15 AM. Which action is most appropriate?

   • ACorrelate the file modification with the service account's process activity to determine if it accessed the file.
   • BAssume the file was modified by malware running under the user's context.
   • CConclude that the user modified the file before logging off and the timestamp is delayed.
   • DIgnore the modification because the user was not logged on.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which tool is commonly used in the timeline creation process to extract file system metadata from a disk image?

   • Atcpdump
   • Bmemdump
   • Chashdeep
   • Dfls
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During a timeline analysis of a compromised workstation, an analyst notices that a large number of files in the user's Documents folder have modification timestamps that are all set to the same minute, but their creation timestamps vary over several days. This pattern is most indicative of what?

   • AThe user manually edited each file within the same minute, which is unlikely but possible.
   • BThe files were all created at the same time, but the creation timestamps were incorrectly recorded.
   • CThe file system is corrupted, causing timestamps to be overwritten with the same value.
   • DA bulk file operation, such as a script or a file synchronization tool, that modified the files at once.
   Reveal Solution Discussion Select an answer first