You are building a timeline of file activity for a system. You have MFT timestamps, USN journal entries, and $LogFile records. Which approach best integrates these artifacts into a coherent timeline?

Use only the MFT timestamps, as they are the most authoritative and complete.

Use only the USN journal, as it records all file system changes.

Use only the $LogFile, as it contains the most detailed transaction records.

Correlate timestamps from MFT attributes with USN journal and $LogFile records, using the most specific artifact for each event type.

How can an investigator use the MFT entry number and sequence number to track file versions?

By correlating the entry number and sequence number in directory indexes and file records to identify when a file was overwritten

By checking the file's permissions

By reading the file's $DATA attribute

What is the primary purpose of the NTFS journal file $LogFile?

To track user access to files for auditing

To record metadata changes for file system transactions to enable recovery after a crash

To store backup copies of all file data

In a timeline you are building, you notice that a file's $STANDARD_INFORMATION (SI) last-write timestamp is 10:00, but the $FILE_NAME (FN) last-write timestamp is 09:45. The file's content hash matches a known malware sample. Which timestamp should you treat as the best evidence of when the file's content was last modified?

Both timestamps, because they are always identical and the difference is a parsing error.

The FN last-write timestamp, because it reflects the actual time the file was written to disk.

The SI last-write timestamp, because it reflects changes to the file's data and metadata.

The earliest timestamp, because it indicates when the file first appeared on the system.

You are analyzing a small text file that appears to have been deleted. The MFT record for the file is intact, and the $DATA attribute's 'Initialized Size' is 512 bytes, but the 'Allocated Size' is 0. What is the most likely reason the file's content is still recoverable?

The file's data is resident within the MFT record, so it remains in the record even after deletion.

The file was compressed, and the compressed data is stored in the $LogFile.

The file's clusters were marked as allocated in the $Bitmap, preserving the data.

The file was encrypted with EFS, and the decryption key is stored in the MFT record.

GIAC Certified Forensic Analyst

Domain 3Objective 3

NTFS Artifact Analysis GCFA Practice Questions (Page 8)

Part of the File System Forensics domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 7–12 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

16concepts

Questions 36–40

36application · medium
You are building a timeline of file activity for a system. You have MFT timestamps, USN journal entries, and $LogFile records. Which approach best integrates these artifacts into a coherent timeline?
Select an answer first
37foundation · easy
How can an investigator use the MFT entry number and sequence number to track file versions?
Select an answer first
38foundation · easy
What is the primary purpose of the NTFS journal file $LogFile?
Select an answer first
39application · medium
In a timeline you are building, you notice that a file's $STANDARD_INFORMATION (SI) last-write timestamp is 10:00, but the $FILE_NAME (FN) last-write timestamp is 09:45. The file's content hash matches a known malware sample. Which timestamp should you treat as the best evidence of when the file's content was last modified?
Select an answer first
40application · medium
You are analyzing a small text file that appears to have been deleted. The MFT record for the file is intact, and the $DATA attribute's 'Initialized Size' is 512 bytes, but the 'Allocated Size' is 0. What is the most likely reason the file's content is still recoverable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.