Manually Finding Data GBFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are examining a Linux system image and need to determine whether a user downloaded a file from a specific website before copying it to a USB drive. Which combination of manual analysis techniques would best establish this sequence of events?

   • ACarve the file from unallocated space and compare its hash to known files from the website.
   • BUse a keyword search for the website URL in the image and then manually review all hits to find the file.
   • CSearch the entire filesystem for the filename and then check the file's permissions to see if it was executable.
   • DExamine browser history for the download, check the file's metadata for creation time, and correlate with the USB mount time from system logs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a manual review of a forensic image, you find a file named 'notes.txt' in the user's Documents folder. The file's content includes a list of passwords. Which additional artifact would you examine to determine if the user accessed this file recently?

   • AThe Windows Prefetch folder for the text editor application.
   • BThe user's browser history.
   • CThe file's creation timestamp.
   • DThe system's event logs for file access.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are manually searching a forensic image for evidence of a specific phrase that may be present in both allocated and unallocated space. You have a keyword list and a hex editor. Which manual technique is most effective?

   • ASearch only the allocated files using the operating system's built-in search function.
   • BSearch only the file system's metadata for the keywords.
   • CPerform a raw string search for each keyword across the entire image, including unallocated space.
   • DUse a data carving tool to recover all deleted files and then search those files.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   You are manually searching a forensic image for evidence of a specific file that may have been deleted. You have already searched the allocated file system and found nothing. You have also searched the unallocated space for keywords and found fragments, but not the complete file. What is the most logical next manual step?

   • AConclude that the file is unrecoverable.
   • BPerform a data carving attempt using the file's signature to recover the complete file from unallocated space.
   • CSearch the file system's slack space for the file's content.
   • DExpand the keyword search to include more variations of the file's content.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which artifact is most likely to show a list of recently accessed documents on a Windows system?

   • ARecent Files (Jump Lists)
   • BSystem Restore points
   • CWindows Event Logs
   • DBrowser cache
   Reveal Solution Discussion Select an answer first