GIAC
GCFE · Question #149
Which timeline artifact records the time files were created, accessed, modified and changed?
The correct answer is B. $MFT. See the full explanation below for the reasoning.
Question
Which timeline artifact records the time files were created, accessed, modified and changed?
Options
- A$Bitmap
- B$MFT
- CEvent logs
- D$LogFile
How the community answered
(32 responses)- A13% (4)
- B78% (25)
- C3% (1)
- D6% (2)
Community Discussion
No community discussion yet for this question.