Practice · GIAC Linux Incident Responder

~/giac-glir · giac-glir_d1_276417ffe354 ▊

← GIAC Linux Incident Responder · practice sheet

giac-glir_d1_276417ffe354 domain/d1 · medium single

An analyst examining an NTFS volume finds that a suspect executable's $STANDARD_INFORMATION timestamps do not match its $FILE_NAME timestamps. Why does comparing these two attribute sets help detect timestamp manipulation?

A The $FILE_NAME attribute stores UTC while $STANDARD_INFORMATION stores local time, so a difference always indicates tampering
B Windows does not typically update $FILE_NAME timestamps the way it updates $STANDARD_INFORMATION, so they frequently reflect creation, move, or rename events
C The $FILE_NAME attribute is updated every time a file is accessed, providing a continuous access history
D $STANDARD_INFORMATION timestamps cannot be modified by any tool, so they are always authoritative

Unlock this exam to join the per-question discussion and vote on questions.

next question →