Manually Finding Data GBFA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   You are manually investigating a case of intellectual property theft. You have found the following artifacts: (1) a browser history showing visits to a file-sharing website, (2) a recently created archive file containing sensitive documents, (3) a USB device history showing a device connected at the same time the archive was created, and (4) the user's email client showing a draft email with a link to the file-sharing website. Which correlation best supports the theory that the user uploaded the archive to the file-sharing site?

   • AThe USB device was connected, but the archive was created before the connection.
   • BThe email draft contains a link to the file-sharing site, but the browser history shows no visit to the site.
   • CThe archive was created at the same time the USB device was connected, and the browser history shows a visit to the file-sharing site shortly after.
   • DThe browser history shows a visit to the file-sharing site, but the archive was never created.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   You are performing a manual search on a forensic image for evidence of a specific file that may have been deleted. You have already searched the allocated file system and found nothing. What is the next most logical manual step?

   • ARebuild the file system's Master File Table (MFT) to recover the file entry.
   • BConclude that the file never existed on the system.
   • CSearch the unallocated space using keyword strings that are likely to appear in the file's content.
   • DExpand the search to include the file system's slack space, but only if the file was small.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are manually navigating a Linux forensic image and need to locate user-specific configuration files that might contain credentials or browsing history. Which directory should you prioritize?

   • AThe /etc directory, which contains system-wide configuration files.
   • BThe /home directory, specifically the user's home folder and its hidden files.
   • CThe /tmp directory, which contains temporary files.
   • DThe /var directory, which contains logs and spool files.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are examining a document on a forensic image and need to determine if it was edited by a specific user. Which metadata or artifact would provide the most reliable evidence?

   • AThe document's 'Last Modified By' property in its metadata.
   • BThe file's location in the user's Documents folder.
   • CThe file's access time, which shows when it was last opened.
   • DThe file's creation time, which shows when it was created.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are manually reviewing a forensic image and have identified a deleted JPEG image that is partially overwritten. You want to recover as much of the image as possible. Which manual approach is most appropriate?

   • AExamine the file's metadata in the $STANDARD_INFORMATION attribute to determine its original location.
   • BUse a data carving tool that supports fragmented file carving to recover the image from unallocated space.
   • CManually search the file system for the original file entry and restore it from the MFT.
   • DPerform a keyword search for 'JPEG' in unallocated space to locate the file header.
   Reveal Solution Discussion Select an answer first