Emma, a forensic investigator, discovers that the attacker has tampered with the timestamp metadata of...

According to theCHFI v11 Operating System Forensicscurriculum, timestamp manipulation is a commonanti-forensics techniqueused by attackers to obscure activity timelines. OnNTFS file systems, each file maintains multiple sets of timestamps—such as$STANDARD_INFORMATIONand$FILE_NAMEattributes—stored within theMaster File Table (MFT). Discrepancies between these timestamp sets are strong indicators oftimestamp tampering.

analyzeMFTis a specialized forensic tool designed explicitly to parse and analyze theNTFS Master File Table. CHFI v11 highlights MFT analysis as a critical method for detectingtime-stomping attacks, where attackers alter file timestamps using utilities like timestomp. analyzeMFT allows investigators to compare multiple timestamp attributes, identify anomalies, reconstruct timelines, and detect inconsistencies that standard file system views cannot reveal.

The other tools are not appropriate for this task.Regshotis used to compare Windows Registry snapshots,OSForensicsis a general forensic suite but is not specifically optimized for low-level MFT timestamp comparison, andProcess Exploreris a live system monitoring tool focused on running processes rather than file system metadata.

CHFI v11 explicitly emphasizesNTFS MFT analysisas the authoritative method for identifying manipulated timestamps. Therefore, the most accurate and CHFI-aligned tool for detecting timestamp modifications on NTFS file systems isanalyzeMFT, makingOption Athe correct answer.