GCFA · Domain 3
Timeline Analysis
About 25% of the exam
MACB timestamps
- M
- content last modified
- A
- last accessed, often disabled
- C
- metadata record changed
- B
- born, the creation time
- Same volume move
- creation survives, record change updates
- Cross volume move
- copy then delete, new creation
- Copy
- new creation, modified time inherited
Learn what each operation does to each timestamp; the exam tests the operation, not the definition
Two timestamp sets in NTFS
- Standard information is easy to alter
- File name times sit in the index
- User tools rarely touch the file name set
- Compare the two sets for disagreement
- Zeroed sub-second values look manufactured
- Round values such as midnight look chosen
- Neighboring files give the honest baseline
Timestomping detection
- All four times identical to the second
- Creation later than the modified time
- File older than the volume itself
- Journal entry disagrees with the record
- Sequence number ordering contradicts the times
- Compile time far from the creation time
Monotonic values such as the journal sequence number keep working after the clock has been lied to
Clock problems
- Time zone
- record it before reading anything
- Daylight saving
- one hour of false ordering
- Clock rollback
- later events carry earlier stamps
- System time change
- logged, so look for it
- Sensor skew
- network and host clocks drift apart
- Normalize
- convert every source to UTC
NTFS structures that date things
Master file table
- One record per file or directory
- Small files stay resident inside the record
- Large files use non-resident run lists
- Attribute list points to extension records
- Alternate data streams hide extra content
Journals
- Transaction log holds recent metadata operations
- Change journal records why each change happened
- The change journal wraps when full
- Sequence numbers only ever increase
- Shadow copies keep older journal states
Other metadata files
- Bitmap tracks cluster allocation
- Boot record identifies the volume layout
- Mirror holds the first table records
- Index entries carry file name times
When the change journal has wrapped, the transaction log and shadow copies are the fallback history
Execution evidence
- Prefetch
- ran, run count, recent runs
- Amcache
- path, size, SHA-1 hash
- ShimCache
- seen by compatibility, modified time
- UserAssist
- interactive launches, focus counts
- BAM and DAM
- last run time per account
- SRUM
- hourly bytes and processor time
- Sysmon 1
- process created with full context
File and folder knowledge
- LNK files
- target path, volume serial, times
- Tracker block
- machine name where target lived
- Jump Lists
- recent and frequent per application
- Shellbags
- folders browsed, removable paths included
- RecentDocs
- documents opened, ordered by recency
- Recycle Bin
- $I metadata, $R content
- Open and save keys
- dialog paths the user chose
Registry as a clock
- Every key carries a last write time
- Values themselves carry no timestamp
- Transaction logs narrow when a change landed
- Backup hives preserve an earlier state
- Shadow copies keep older hive versions
- USB keys date first and last connection
Building a super timeline
- Collect artifacts
- Parse with many modules
- Set the source time zone
- Merge and deduplicate
- Filter to a window
- Pivot and narrate
A raw super timeline is unreadable; the analysis is the filtering, not the parsing
Pivoting through the noise
Anchors
- First malicious network connection
- Dropped file creation time
- Service or task installation
- Suspicious logon event
Slicing
- Window minutes either side of an anchor
- Filter by user, host or path
- Follow one file across all sources
- Deduplicate identical parser output
Narrative chain
- Delivery, execution, persistence, movement, exfiltration
- Each step needs its own artifact
- Gaps are findings, not filler
- State confidence for each inference
Download, creation, first run and outbound bytes in order is the classic delivery to exfiltration story
Recovering deleted history
- Shadow copies preserve earlier file states
- Deleted records may survive in the table
- Carve unallocated space for lost content
- Journals still name files that are gone
- Backups predate the attacker activity
- Index slack retains removed entries
Presenting the timeline
- One row, one artifact, one source
- Use a single reference time zone
- Show only events that carry the story
- Mark inferred times as inferred
- Keep the full timeline as an exhibit
- Explain why a gap exists
Rapid recall
- Body file
- intermediate metadata format for timelines
- Super timeline
- many artifact types merged chronologically
- Sequence number
- monotonic journal counter, survives timestomping
- Resident data
- content stored inside the record
- Slack
- old bytes after the file end
- Shadow copy
- point in time volume snapshot
- Time slice
- events around one chosen moment
Know the order
- Fix the time zone
- Anchor on a known event
- Expand outward in minutes
- Corroborate with a second source
- Write the narrative
Anchor, expand, corroborate: an event with only one source is a lead, not a finding
Reference strip: artifacts by question
Did it run
- Prefetch and Amcache
- UserAssist for interactive launches
- Background activity keys
- Process creation events
Was it opened
- LNK files and Jump Lists
- RecentDocs and office recent lists
- Shellbags for folder browsing
- Dialog path keys
What changed
- Change journal and transaction log
- File table record times
- Registry key write times
- Shadow copy differences
Who and when
- Logon and logoff events
- Explicit credential use
- Account and group changes
- Remote session logs
Time hazards
- Time zone and daylight saving
- Clock changes and rollbacks
- Sensor and host skew
- Timestomped and rounded values
Quick exam traps
- Trap: The file name timestamps cannot be altered at all
- Trap: Access time reliably proves a user opened the file
- Trap: A same volume move resets the creation time
- Trap: ShimCache entries record when the program ran
- Trap: The change journal keeps a permanent history
- Trap: A super timeline with everything in it is the deliverable
- Trap: Matching timestamps across artifacts always mean one event
cybercertprep.com · original revision sheet written from the public body of knowledge