Manually Finding Data GBFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   In a Windows forensic image, you need to find evidence of a user's web browsing activity. Which file system location should you manually navigate to first?

   • AC:\Users\<username>\AppData\Local\Microsoft\Windows\WebCache
   • BC:\Windows\System32\config
   • CC:\Program Files\Internet Explorer
   • DC:\Users\<username>\Documents
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   You are manually analyzing a forensic image and need to determine whether a user accessed a specific file on a given day. The file's last access timestamp is not updated because the system has disabled last access time updates. Which manual method can still help you determine if the file was accessed?

   • AExamine the Windows Prefetch files to see if the application that opens the file was run on that day.
   • BCheck the file's creation timestamp to see if it was created on that day.
   • CLook at the file's modification timestamp to see if it was modified on that day.
   • DSearch the browser history for the file's name.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   You are manually reviewing a forensic image and need to find all files that contain a specific keyword, but the keyword may be obfuscated or split across multiple files. Which manual search technique is most effective?

   • ACarve all files from unallocated space and then search for the keyword.
   • BUse a string search tool with regular expressions to account for variations and partial matches.
   • CManually navigate to each directory and open every file to look for the keyword.
   • DPerform a simple string search for the exact keyword in all files.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a manual triage of a Windows 10 forensic image, you need to quickly determine whether the user accessed a specific cloud storage website in the last 30 days. You have no timeline analysis tool and only a raw image mounted read-only. Which approach is the most systematic and efficient manual method?

   • AOpen the browser's history database with a text editor and search for the domain.
   • BSearch the raw image for the domain name as a string, then examine the surrounding bytes to identify the browser and timestamp.
   • CNavigate to the user's Downloads folder and look for files with the cloud provider's name in the filename.
   • DRun a full file system forensic scan for deleted files and then manually review all recovered files.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When performing a keyword search on a forensic image, which technique is most effective for finding relevant data?

   • ASearching only the file system metadata
   • BUsing a list of keywords and searching both allocated and unallocated space
   • CSearching for exact file names only
   • DSearching only the Windows Registry
   Reveal Solution Discussion Select an answer first