Introduction to File System Timeline Forensics GCFA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A forensic analyst is correlating a file system timeline with network logs. The timeline shows that a file named 'data.zip' was created at 2:00 PM, and the network logs show an outbound connection to a cloud storage service at 2:05 PM. The analyst also finds that the user's browser history shows a visit to the cloud storage website at 2:04 PM. What is the most reasonable conclusion?

   • AThe user likely created the zip file and then uploaded it to the cloud storage service.
   • BThe outbound connection was likely a background process, not related to the file.
   • CThe timeline is inconclusive because file creation times are not reliable.
   • DThe user definitely exfiltrated the file, and the evidence is conclusive.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   You are investigating a data exfiltration incident. Your timeline shows a large archive file was created on a workstation at 2:00 PM. The corporate firewall logs show an outbound FTP connection to an external IP at 2:05 PM. Which additional evidence would most strengthen the case that the archive was exfiltrated?

   • AThe user's browser history shows they visited a file-sharing website at 1:55 PM.
   • BThe archive file's internal metadata shows it was compressed with a specific tool.
   • CThe system's event log shows a successful logon at 1:58 PM.
   • DThe FTP client's configuration file on the workstation shows the external IP and a recent connection entry.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An analyst is building a timeline from a forensic image of a Linux server that hosts a web application. The goal is to determine if an attacker modified any web pages. The analyst has already extracted the file system metadata. Which additional data source should be incorporated to provide the most context for the timeline?

   • AThe system's syslog messages, which may contain kernel and service errors.
   • BThe bash history of the root user, which may show commands used to edit files.
   • CThe package manager logs, which show software installations and updates.
   • DWeb server access logs that show requests for the web pages.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   You are building a timeline for a system that was imaged after a power failure. The file system is NTFS. You notice that some file modification times in the $MFT are inconsistent with the $LogFile records. What is the most likely explanation?

   • AThe $MFT timestamps are always correct, and the $LogFile contains errors.
   • BThe $LogFile is not a reliable source of timestamps and should be ignored.
   • CThe $MFT may contain timestamps that were not flushed to disk before the power failure, while the $LogFile may contain more recent transactional records.
   • DThe power failure caused the $MFT to be corrupted, so the timeline should be built only from the $LogFile.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   In a timeline you built from a Windows system, you notice a cluster of file creation events in the user's Downloads folder at 2:00 AM, followed by execution of a newly created .exe file. The user claims they were asleep. Which analysis technique is most appropriate to determine whether the activity was automated?

   • AExamine the file's MAC times to see if the access time is earlier than the creation time.
   • BLook for the file's presence in the user's Recent Files list.
   • CCorrelate the timeline entries with scheduled task creation events and Windows event logs for Task Scheduler.
   • DCheck the file's digital signature and publisher information.
   Reveal Solution Discussion Select an answer first