Chapter 21 — Exercises

Twenty-eight problems in seven groups, mixing concept checks, conversion drills, hands-on labs (decode an MFT record by hand, build the bodyfile and the super-timeline, hunt the timestomp, read the gaps, write the master-timeline exhibit), and judgment questions. Hands-on labs assume a practice image and the Sleuth Kit / plaso / Eric Zimmerman / Timeline Explorer toolset from Appendix J — Practice Images and Lab Setup. (answer in Appendix) = worked solution in Answers to Selected. ⭐ = stretch. Always build timelines from a verified image or hashed copies — never the original; running fls, plaso, or even mounting the evidence updates times and taints everything downstream. Build in UTC; convert to local only at the very end, and say so.

Group A — How computers tell time: epochs and resolution

21.1 Explain the sentence "a timestamp is a number plus a convention." Name the two parts of the convention you must know before a raw value means anything, and give one concrete consequence of getting each part wrong (one example that lands an event in the wrong century, one that gives you false precision). Why is this, and not "finding timestamps," the genuinely hard part of timeline analysis? (answer in Appendix)

21.2 Convert between the two epochs you meet most. (a) State, in words and as a number, the constant 116,444,736,000,000,000 — what it counts, between which two dates, and why it bridges FILETIME and Unix time. (b) Write both conversion formulas (FILETIME → Unix seconds, Unix → FILETIME). (c) The forged $SI creation time in the anchor case is 2022-02-11 10:00:00 UTC. Show that this corresponds to Unix second 1,644,573,600, then describe the steps to turn that into a FILETIME using the constant. (d) Why does dividing by 10,000,000 appear in the FILETIME→Unix direction?

21.3 ⭐ Walk the epoch zoo. For each of FILETIME, Unix/POSIX, WebKit/Chrome, Firefox PRTime, Cocoa/CFAbsoluteTime, HFS+, and DOS/FAT, state the epoch (zero date) and the unit. Then: (a) a Chrome History value read as if it were Unix seconds lands roughly where, and why is WebKit time simply "FILETIME ÷ 10"? (b) A Safari visit recorded in Cocoa time, read as Unix seconds, is off by how many years and in which direction — name the exact constant. (c) Which two of these formats do not count from 1970, and which single format stores local time with no zone at all?

21.4 Reason from the resolution table. (a) State the timestamp resolution and the time standard (UTC vs local) for NTFS, FAT32 (write and access separately), exFAT, ext4, and APFS. (b) Explain precisely why you cannot sequence two writes that occurred 1.2 seconds apart on a FAT32 volume, but you can on NTFS. (c) The chapter calls NTFS's 100-ns resolution "a forensic gift the forger usually forgets to fake." Restate that idea in your own words — what does the forger usually get wrong about sub-seconds, and why?

Group B — Time zones, normalization, and clock skew

21.5 Normalize a mixed-source timeline to UTC. An evidence workstation's SYSTEM\ControlSet001\Control\TimeZoneInformation shows Bias = 480, ActiveTimeBias = 420, TimeZoneKeyName = "Pacific Standard Time". (a) What absolute UTC offset does Bias = 480 represent, and what does ActiveTimeBias = 420 tell you that Bias alone does not? (b) A FAT-formatted USB volume in the case carries a file write time of 2024-03-15 11:58:13 local. Convert it to UTC, stating which bias you applied and why. (c) Write the single chain-of-custody sentence your report must contain about the time standard, naming the registry key you read. (answer in Appendix)

21.6 Measure clock skew. A workstation recorded the send of an email at 2024-03-15 18:51:05, while the corporate mail server's Received header stamped the same message at 2024-03-15 18:51:07 UTC. (a) Compute the skew, state its direction (is the machine fast or slow?), and give the correction you would apply to every machine-recorded time. (b) Why must you confirm the offset against a second independent external reference before trusting it? (c) Name two external references, besides a mail-server Received header, that can serve as the trusted clock.

21.7 ⭐ Read a clock change. Your .evtx timeline contains a Windows event ID 4616, "the system time was changed," at 02:10 recording an old value of 2024-03-15 18:40:00 and a new value of 2024-03-12 09:00:00, performed by a user account (not the w32time service). (a) What does this single event tell you about every timestamp written between the change and any later correction? (b) Why is "segment the timeline at each clock change and re-anchor" the correct response rather than "apply one constant offset"? (c) Why is a 4616 not attributable to w32time a much louder signal than one that is?

21.8 A junior examiner merges a UTC .evtx logon record at 18:51 with a FAT thumb-drive write recorded at 18:55 local (the machine's zone is Pacific, UTC−7 during DST) without converting either, and concludes "the file was written to the USB four minutes after the logon." Show the corrected UTC times, state what actually happened relative to the logon, and explain in one sentence why the chapter calls mixing time zones "the cardinal sin."

Group C — MACB and the two NTFS timestamp sets

21.9 Define the MACB model precisely. Give the one-line meaning of M, A, C, and B, and explain the single letter that trips up almost everyone — what C actually records, and why it is not the file's creation time (which letter is creation?). Then state why the Sleuth Kit's mactime tool, not the everyday names, fixed this vocabulary for the field. (answer in Appendix)

21.10 Map the file-system fields to MACB letters. (a) For NTFS, map the four $STANDARD_INFORMATION`/`$FILE_NAME fields (Created, File-Modified, MFT-Modified, Accessed) to their MACB letters. (b) For ext4, map i_crtime, i_mtime, i_ctime, i_atime to MACB. (c) Why does a row in a mactime listing showing macb together at one instant almost always mean "a file was just created," while m.c. means something different — and what?

21.11 State the behavior rules. For each operation — create a new file, modify content, rename within a volume, copy a file to a new location, download from the web, and open-without-writing — say which of M/A/C/B change under Windows 10/11 defaults. Then explain, in two sentences, why a file showing Created 2024-03-15, Modified 2024-03-10 (B after M) is the normal signature of a copy or download and not, by itself, evidence of timestomping. What single comparison confirms it is benign?

21.12 ⭐ Why does NTFS keep two MACB sets, and why does that asymmetry matter? (a) Name the two attributes (with their type numbers) and state which one Explorer/dir/PowerShell display. (b) State which set has a documented user-space API to write it and which is maintained only by the kernel — and therefore which is forgeable and which is the one to trust. (c) Write the one-sentence rule, short enough to recite on the stand, that captures this asymmetry.

Group D — Detecting timestamp manipulation (the anchor)

21.13 ⭐ Lab — decode the timestomp by hand. Below is the timestamp-bearing slice of the MFT record for C:\Users\jrivera\Desktop\TurbineHousing_v7.sldprt from the verified image WS-ENG-04.E01. The $STANDARD_INFORMATION` ($SI, type0x10) and$FILE_NAME` ($FN, type 0x30) attributes each hold a full MACB set:

$SI  B/M/C/A  (all four):  00 10 98 21 2E 1F D8 01   →  2022-02-11 10:00:00.0000000
$FN  B/M/C/A  (all four):  02 43 33 BB 0A 77 DA 01   →  2024-03-15 18:58:13.4928130

(a) State which set Windows Explorer would display, and what date a user browsing the Desktop would therefore see. (b) List every timestomping tell present in this record — name at least four, including the sub-second observation and the impossible ordering. (c) Explain, in one sentence each, why the $SI` set is the lie and the `$FN set is the truth. (d) Name the single corroborating artifact you would pull next to prove the true creation time independently, and what record type within it you expect to find. (answer in Appendix)

21.14 Reproduce the five-tell timestomping checklist from memory: (1) $SI` earlier than `$FN, (2) zeroed sub-seconds, (3) $SI` Modified before `$SI Born on a non-copied file, (4) times predating the OS install or volume creation, (5) implausible $SI`/`$FN divergence or a directory sharing one identical round timestamp. For each tell, give one innocent explanation that could produce it without manipulation (e.g., file-system tunneling, restore-from-backup, an installer). What does the existence of these innocent exceptions tell you about how to report a stomping finding?

21.15 Decide stomping vs. benign for three files, each by comparing $SI` Born to `$FN Born: - File X: $SI` Born `2022-02-11 10:00:00.0000000`, `$FN Born 2024-03-15 18:58:13.4928130. - File Y: $SI` Born `2024-03-15 19:04:55.7720010`, `$SI Modified 2024-03-10 08:12:31.2210 (older), $FN Born 2024-03-15 19:04:55.7720010. - File Z: $SI` Born `2020-01-04 03:00:00.0000000`, `$FN Born 2020-01-04 03:00:00.0000000, both predating the volume's format date of 2021-06-01.

For each, state your conclusion (stomped / benign copy-download / impossible-needs-investigation) and the one observation that decides it.

21.16 Corroborate with the NTFS transaction records. (a) What does $Extend\$UsnJrnl:$J` log for each change, and which *reason flag* would independently confirm that `TurbineHousing_v7.sldprt` was created on 2024-03-15? (b) What does `$LogFile add that $J` may not? (c) Why is "the `$FN Born and a USN_REASON_FILE_CREATE record agree to the second" described as the gold standard for proving a true creation time, and what tool reads $J?

21.17 ⭐ State the limit of $FN`. The chapter calls `$FILE_NAME "strong, not sacred." (a) Name two ways a sufficiently capable adversary can forge $FN itself or defeat the change journal. (b) What is the only reliable defense once you accept that any single artifact can be forged? (c) Rewrite the overconfident sentence "the file was definitely timestomped" into a defensible finding that states the same conclusion with its confidence and its corroboration.

Group E — Building the super-timeline: the tools

21.18 Lab — build the file-system spine. From the verified image WS-ENG-04.E01 (NTFS partition at sector offset 2048): (a) write the fls command that emits a bodyfile recursively, including deleted entries still in the MFT, and explain each flag (-m, -r, -o). (b) Write the mactime command that renders a UTC timeline for 03/15/2024 through 03/16/2024 as comma-delimited output, and explain -b, -d, and -z. (c) State the one step you must perform on both the bodyfile and the output and record in your chain-of-custody worksheet, and why. (answer in Appendix)

21.19 Reconstruct the bodyfile format. Name the 11 pipe-delimited fields of the TSK 3.x bodyfile in order, and identify which four are the A, M, C, and B times (and in what epoch they are stored). What string is appended to the name field for a deleted entry, and which recurring theme does that single annotation embody?

21.20 Lab — build the everything-timeline. (a) Write the log2timeline.py command that collects every parser's output from WS-ENG-04.E01 into one storage file, and say why this step is slow. (b) Write the psort.py command that renders a dynamic-format CSV filtered to 2024-03-15 00:00:00 through 2024-03-16 23:59:59. (c) A few months of one workstation can exceed a million events. State the rule the chapter gives for why you build the super-timeline but never read it raw — and the three-word workflow that replaces linear reading.

21.21 Interpret a mactime excerpt and recover the truth. In a default mactime -d -z UTC view, TurbineHousing_v7.sldprt appears at 2022-02-11 10:00:00 with the MACB column macb, conspicuously outside the Friday-2024 cluster where its LNK, the USB connection, and the ShellBag all sit. (a) Why does the file land at 2022 in this view — which timestamp set does mactime report by default? (b) Which tool and command place both $SI` and `$FN side by side so the divergence is visible in one scan, and what true creation instant does $FN give for this file? (c) Explain the meaning of the MACB column values b..., macb, and m.c..

21.22 ⭐ The dual-use bodyfile. The same fls -r bodyfile serves both disciplines. (a) Explain how a 🔍 forensic examiner uses it (which times, to what end). (b) Explain how a 💾 recovery technician uses the identical command on a damaged volume (which times, to what end, and how deleted entries help). (c) State the one-line "one command, two missions" idea in your own words, tying it to the theme deleted ≠ destroyed.

Group F — Reading the timeline: pivoting, windows, corroboration

21.23 Apply anchor → window → expand. Your strongest anchor in the anchor case is the USBSTOR connection at 2024-03-15 18:51:07. (a) Define what makes an event a good "anchor." (b) Filter to a ±10-minute window and list, from the chapter's master timeline, the events that cluster and corroborate the anchor. (c) Explain why an examiner who scrolls a million-line CSV top to bottom will miss the story that an examiner who pivots from this anchor finds in minutes. (answer in Appendix)

21.24 Distinguish a lead from a finding. (a) Define each in one sentence using the chapter's standard. (b) In the anchor case, the device connection is corroborated by USBSTOR, the per-user MountPoints2 last-write, a ShellBag, a LNK volume serial, and a Jump List. Explain why this convergence is a finding that "no single artifact's ambiguity can break." (c) Give one example of two events close in time that are a coincidence, not a relationship, and state the reporting rule that keeps you honest.

21.25 Read the gaps. In the anchor case, the morning after the exfiltration: files go to the Recycle Bin at 09:12, CCleaner runs at 09:14:22 with free-space wiping enabled, and in the same minute the browser history ends and several MRU lists are emptied while their keys' last-write times all read 09:14. (a) Explain why these empty-but-recently-written keys are evidence of an action, not of disuse. (b) Which recurring theme does "the gap has coordinates" embody? (c) Name two other timeline silences (one in a Security log, one in browser history) that are themselves dated evidence.

21.26 ⭐ Proximity is not causation. A timeline shows a phishing email opened at 10:02:11 and a malicious service installed at 10:02:14. (a) State the hypothesis the three-second proximity suggests. (b) State what the proximity does not prove on its own. (c) List two additional artifacts that would convert the temporal correlation into a defensible causal sequence, and write the sentence you would put in the report before you have them (a correlation stated as a correlation).

Group G — The report and the progressive project

21.27 Write the master-timeline finding (anchor case #2, the departing engineer). Using only the corroborated events on the chapter's WS-ENG-04 master timeline, write a ~150-word Findings paragraph that answers counsel's question — did jrivera copy proprietary turbine-housing files to a personal device before resigning? — that: (a) states the time standard in one sentence and that no event ID 4616 was present; (b) lays out the sequence (device connection → folder browse → local copy created → opened from removable drive → cloud/email exfiltration → device removed → next-morning deletion and wipe), each line sourced to an artifact; (c) flags the forged $SI` 2022 date and anchors the true creation on `$FN plus the USN journal; (d) pairs every load-bearing conclusion with its limit and asserts no intent. A competent cross-examiner should find nothing to impeach. (answer in Appendix)

21.28 Progressive project — build the master timeline for the case. Add this chapter's deliverable to your Forensic Case File (running since Chapter 5). (1) Establish the time standard: read TimeZoneInformation from the SYSTEM hive; measure clock skew against at least one external reference; check for event ID 4616; document the standard in one sentence. (2) Build two timelines: an fls -m -r → mactime -z UTC file-system spine and a log2timeline.py → psort.py super-timeline; hash both intermediate files into your chain-of-custody worksheet (Appendix F); pull $SI` *and* `$FN with MFTECmd. (3) Hunt timestomping: scan the $MFT` export for the five tells; corroborate each flagged file with `$UsnJrnl:$J; record forged-vs-true times. (4) Merge, slice, pivot: load everything into Timeline Explorer, filter to the incident window, pivot from your strongest anchor, tag the load-bearing events, and confirm each with a second source and a second tool. (5) Write the exhibit: produce a clean, UTC, source-annotated master-timeline table, manipulated times flagged and explained, limits noted beside any single-source or proximity-only line. Save the bodyfile, the .plaso, the psort slices, the MFTECmd export, and the exhibit into the case-file folder, and list their SHA-256 hashes in your submission. The capstone in Chapter 38 assembles the whole file.

Self-check. You have mastered this chapter when you can take a heap of CSV exports from a dozen artifact types and fuse them into one UTC-normalized, source-annotated, corroborated timeline — and defend every line of it. If you can convert any of the common timestamp formats to UTC, measure and document clock skew, decode an MFT record by hand to expose a timestomp and anchor the truth on $FN plus the USN journal, build the timeline with both fls/mactime and log2timeline/plaso, read it by pivoting from anchors and weighing corroboration, treat a dated gap as evidence, and write the anchor-case findings paragraph in 21.27 so that a cross-examiner finds nothing to impeach, you are ready for Chapter 22 — Memory Forensics, where you move from the timestamps on disk to the volatile world of RAM and add a layer of now to the then you just learned to reconstruct.