An investigator is reviewing an NTFS file system for evidence of file activity during a cybercrime investigation. The investigator uses The Sleuth Kit's fls and mactime tools to extract and analyze…

Question

Options

• AInvestigator focuses on the file creation time, last accessed time, and file modification time.
• BInvestigator analyzes the file system's internal structure, time-related metadata, and block
• CInvestigator checks the system's boot time and shutdown timestamps to understand the system's
• DInvestigator reviews the timestamps in Windows event logs for any recorded file access or

• A
  74% (26)
• B
  9% (3)
• C
  3% (1)
• D
  14% (5)

Explanation

Within the CHFI v11 syllabus under Operating System Forensics and Image/Evidence Examination and Event Correlation, timeline reconstruction is a core forensic technique used to understand what happened, when it happened, and in what order. When analyzing NTFS file systems, investigators rely heavily on MAC times--Modified, Accessed, and Created timestamps-- to establish file activity. The Sleuth Kit tools fls and mactime are specifically designed for this purpose. The fls tool extracts file and directory metadata from a forensic image, while mactime processes this metadata to generate a chronological timeline of file system events. This timeline typically includes file creation time, last modification time, and last access time, allowing investigators to correlate file activity with known incident times, user actions, or attacker behavior.

No community discussion yet for this question.