GIAC
GCFE · Question #78
What is the importance of the 'Last Access Time' timestamp in the context of forensic investigations? (Choose Two)
The correct answer is A. It shows the last time a file was accessed, helping to establish a timeline of user activity D. It can indicate potential tampering with evidence. See the full explanation below for the reasoning.
Question
What is the importance of the 'Last Access Time' timestamp in the context of forensic investigations? (Choose Two)
Options
- AIt shows the last time a file was accessed, helping to establish a timeline of user activity
- BIt records the last system update
- CIt details changes in file permissions
- DIt can indicate potential tampering with evidence
How the community answered
(41 responses)- A76% (31)
- B10% (4)
- C15% (6)
Community Discussion
No community discussion yet for this question.