A forensic analyst receives a hard drive containing malware quarantined by the antivirus application. After creating an image and determining the directory location of the malware file, which of the…

Question

Options

• AThe malware file's modify, access, change time properties.
• BThe timeline analysis of the file system.
• CThe time stamp of the malware in the swap file.
• DThe date/time stamp of the malware detection in the antivirus logs.

• A
  7% (2)
• B
  76% (22)
• C
  3% (1)
• D
  14% (4)

Explanation

Timeline analysis of the file system (B) correlates timestamps from multiple sources - file creation, modification, access, MFT (Master File Table) entries, log files, and other artifacts - to reconstruct a chronological sequence of events. This provides the most comprehensive and reliable picture of when the malware first appeared on the system. Individual file MAC (Modify/Access/Change) times (A) can easily be manipulated by malware as an anti-forensics technique, making them unreliable alone. The swap file timestamp (C) only reflects when the malware was loaded into memory, not initial infection. Antivirus detection logs (D) show only when the AV detected the threat, which is often long after the initial compromise.

No community discussion yet for this question.