PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 4 : Possible timestamp manipulation, because user-level timestomping tools typically alter only $STANDARD_INFORMATION

Advertisement

Detailed Solution

सही उत्तर Possible timestamp manipulation, because user-level timestomping tools typically alter only $STANDARD_INFORMATION है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

An NTFS file shows a creation timestamp of 2024 in its $STANDARD_INFORMATION attribute but 2021 in its $FILE_NAME attribute. What does this discrepancy most likely indicate? / NTFS फाइल के $STANDARD_INFORMATION में निर्माण समय 2024 दिखता है लेकिन $FILE_NAME में 2021। यह अंतर सबसे अधिक क्या दर्शाता है?

1.
Normal behavior, because both attributes are always synchronized by Windows
2.
Disk corruption, because the two attributes can never legitimately differ
3.
A different time zone setting on the examiner's workstation
4.
Possible timestamp manipulation, because user-level timestomping tools typically alter only $STANDARD_INFORMATION

Correct Answer: Possible timestamp manipulation, because user-level timestomping tools typically alter only $STANDARD_INFORMATION

$FILE_NAME timestamps are updated only by the filesystem itself on rename/move, so most timestomping tools leave them untouched — a mismatch is a classic anti-forensics indicator. / $FILE_NAME टाइमस्टैम्प सिर्फ फाइलसिस्टम अपडेट करता है, इसलिए टाइमस्टॉम्पिंग टूल आमतौर पर इन्हें नहीं बदलते; अंतर छेड़छाड़ का संकेत है। Option (c) is the trap — time zones shift displayed times uniformly, not one attribute.

Downloaded from PrepSnap (prepsnap.in)