Manually Finding Data GBFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   On a Windows forensic image, which directory is the default location for user-specific files such as Documents and Downloads?

   • AC:\ProgramData
   • BC:\Windows\System32
   • CC:\Users\<username>
   • DC:\Program Files
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common source of data for building a forensic timeline?

   • ARAM contents
   • BFile system metadata (MAC times)
   • CNetwork packet captures
   • DHard drive serial numbers
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are constructing a timeline from a forensic image and notice that a file's modification time is later than the last shutdown time of the system. What is the most likely explanation?

   • AThe file was modified by a scheduled task after shutdown.
   • BThe system clock was changed after the last shutdown, or the file was modified by another system.
   • CThe file was modified during the shutdown process.
   • DThe timeline analysis is incorrect due to timezone settings.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a manual review of a Windows 10 forensic image, you need to locate any references to a specific project codename 'Project Phoenix' that may appear in emails, documents, or web searches. You have already identified several files of interest but want to ensure you don't miss data in unallocated space or file slack. Which approach best combines manual search techniques to achieve this?

   • ARun a string search for 'Project Phoenix' across the entire image, then manually review hits in allocated files and carve relevant data from unallocated space.
   • BCarve all files from unallocated space first, then use a hex editor to manually scan for the codename in each carved file.
   • CUse a keyword search only on the files you've already identified as interesting, since unallocated space is unlikely to contain relevant data.
   • DPerform a timeline analysis of file creation times and then manually open every document created around the project period.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are manually reviewing a forensic image and need to find all evidence of a user's recent activity, including files opened, websites visited, and documents created. Which systematic manual search approach would be most comprehensive?

   • ANavigate to the root of the file system and manually review every directory.
   • BSearch the entire image for the user's username and review all hits.
   • CExamine user-specific locations (e.g., AppData, Recent Files, browser history) and correlate timestamps.
   • DRun a keyword search for common file extensions like .docx and .pdf.
   Reveal Solution Discussion Select an answer first