312-49v11 practice question 1 of 25

An investigator is reviewing an NTFS file system for evidence of file activity during a cybercrime investigation. The investigator uses The Sleuth…

An investigator is reviewing an NTFS file system for evidence of file activity during a cybercrime investigation. The investigator uses The Sleuth Kit’s fls and mactime tools to extract and analyze timestamps related to file actions. These timestamps can provide critical insights into the sequence of events leading up to and during the incident. What kind of file information is the investigator likely focusing on to reconstruct the timeline?

Answer options

A: Investigator focuses on the file creation time, last accessed time, and file modification time. Correct answer

B: Investigator analyzes the file system's internal structure, time-related metadata, and block allocation details for file storage.

C: Investigator checks the system's boot time and shutdown timestamps to understand the system's operational periods.

D: Investigator reviews the timestamps in Windows event logs for any recorded file access or modification times.

Correct Answer:

A. Investigator focuses on the file creation time, last accessed time, and file modification time.

Explanation

The investigator is focusing on the file creation time (birth), last accessed time, and file modification time. The Sleuth Kit's mactime tool is specifically designed to create a chronological timeline of file system activity by parsing the MACB (Modified, Accessed, Changed, Birth) timestamps extracted from the file system's metadata. The fls tool extracts this metadata, including timestamps, from a disk image, and mactime organizes it to help reconstruct the sequence of events, which is the investigator's goal.

Why Incorrect

B. This is too general; the specific focus of mactime is on the timestamps within the metadata, not the entire internal structure.
C. System boot and shutdown times are found in system logs or the registry, not analyzed directly from file system metadata by fls and mactime.
D. Windows event logs are a separate source of evidence; fls and mactime operate on the raw file system data, not the event log files.

References

- Carrier

B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 12

"Timelines

" Carrier explains

"The mactime tool... creates a timeline of file activity based on the MAC times in a body file." (p. 315).

- The Sleuth Kit (TSK) Wiki. (n.d.). Mactime. Retrieved from https://wiki.sleuthkit.org/index.php?title=Mactime. The official documentation states

"Mactime creates an ASCII time line of file activity based on the body file generated by fls." It details the collection of modified

access

and change times.

- MIT OpenCourseWare. (2014). 6.858 Computer Systems Security

Lecture 18: Digital Forensics. Massachusetts Institute of Technology. The lecture notes discuss timeline analysis using tools like mactime to sort events based on file MAC timestamps.

Keep practicing

Take the free 312-49v11 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test