Computer Hacking Forensic Investigator (CHFI v10) — Question 373

The MAC attributes are timestamps that refer to a time at which the file was last modified or last accessed or originally created. Which of the following file systems store MAC attributes in Coordinated Universal Time (UTC) format?

Answer options

• A. File Allocation Table (FAT)
• B. New Technology File System (NTFS)
• C. Hierarchical File System (HFS)
• D. Global File System (GFS)

Correct answer: B

Explanation

The correct answer, NTFS, is designed to store timestamps in UTC format, making it a reliable choice for time-sensitive operations. In contrast, FAT and HFS often store timestamps in local time, which can lead to inconsistencies, while GFS does not standardize on UTC for MAC attributes.