A forensic analyst receives a hard drive containing malware quarantined by the antivirus application. After creating an image and determining the directory location of the malware file, which of the following helps to determine when the system became infected?

Question

Accepted Answer

B. The timeline analysis of the file system. Timeline analysis aggregates MAC (modify, access, change) timestamps from every file and directory on the file system into a unified, chronological event log, allowing the analyst to identify the earliest traceable activity associated with the malware. This method reveals the full infection chain - including dropped files, registry writes, and related artifacts - rather than relying on a single potentially manipulated or delayed indicator. It provides context that no single file or log entry can supply on its own.

Answer

A. The malware file's modify, access, change time properties. The MAC time properties of the malware file alone can be trivially manipulated by an attacker using timestomping tools, making them an unreliable standalone indicator of actual infection time.

Answer

C. The time stamp of the malware in the swap file. The swap file is a volatile, frequently overwritten virtual memory artifact that does not reliably preserve original timestamps and cannot be used to pinpoint the precise time of initial infection.

Answer

D. The date/time stamp of the malware detection in the antivirus logs. The AV detection log timestamp records only when the antivirus engine identified the threat, which may be days or weeks after the actual infection occurred, depending on when signatures were updated.

A forensic analyst receives a hard drive containing malware quarantined by the antivirus application. After creating an image and determining the directory location of the malware file, which of the…

Question

Options

How the community answered

Why each option

Topics

Community Discussion