Emma, a forensic investigator, discovers that the attacker has tampered with the timestamp metadata of several files, making it difficult to accurately determine when the files were created…

The correct answer is A. analyzeMFT. According to the CHFI v11 Operating System Forensics curriculum, timestamp manipulation is a common anti-forensics technique used by attackers to obscure activity timelines. On NTFS file systems, each file maintains multiple sets of timestamps--such as $STANDARD_INFORMATION and…

Defeating Anti-Forensics Techniques

Question

Emma, a forensic investigator, discovers that the attacker has tampered with the timestamp metadata of several files, making it difficult to accurately determine when the files were created, accessed, or modified. Emma needs to identify files with manipulated timestamps to uncover hidden evidence. Which of the following tools can Emma use to detect timestamp modifications on NTFS file systems?

Options

AanalyzeMFT
BRegshot
COSForensics
DProcess Explorer

How the community answered

(34 responses)

A
79% (27)
B
3% (1)
C
6% (2)
D
12% (4)

Explanation

According to the CHFI v11 Operating System Forensics curriculum, timestamp manipulation is a common anti-forensics technique used by attackers to obscure activity timelines. On NTFS file systems, each file maintains multiple sets of timestamps--such as $STANDARD_INFORMATION and $FILE_NAME attributes--stored within the Master File Table (MFT). Discrepancies between these timestamp sets are strong indicators of timestamp tampering. analyzeMFT is a specialized forensic tool designed explicitly to parse and analyze the NTFS Master File Table. CHFI v11 highlights MFT analysis as a critical method for detecting time- stomping attacks, where attackers alter file timestamps using utilities like timestomp. analyzeMFT allows investigators to compare multiple timestamp attributes, identify anomalies, reconstruct timelines, and detect inconsistencies that standard file system views cannot reveal.

Topics

#NTFS forensics#timestamp manipulation#MFT analysis#analyzeMFT

Community Discussion

No community discussion yet for this question.

Full 312-49V11 Practice