Manually Finding Data GBFA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In an investigation, which metadata can help infer the origin of a file?

   • AFile size
   • BAuthor or creator information
   • CFile permissions
   • DFile extension
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You are manually navigating a Windows 10 forensic image and need to locate the user's recently accessed files. Which file system location is most likely to contain this information?

   • AThe user's AppData\Roaming\Microsoft\Windows\Recent folder.
   • BThe C:\Program Files folder.
   • CThe C:\Users\Public folder.
   • DThe C:\Windows\System32 folder.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of timeline analysis in digital forensics?

   • ATo identify the owner of a file
   • BTo search for keywords in files
   • CTo recover deleted files
   • DTo correlate file activity and user actions over time
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   You are manually analyzing a forensic image from a Windows system. The user is suspected of copying sensitive files to a USB drive and then deleting them. You have the following artifacts: (1) USB device history showing a device was connected at 14:00, (2) file system metadata showing several sensitive files were last modified at 14:05, (3) the Recycle Bin is empty, and (4) the MFT shows the files were deleted at 14:10. Which manual conclusion is most defensible?

   • AThe files were likely copied to the USB drive and then deleted, based on the sequence of connection, modification, and deletion.
   • BThe files were deleted first, then the USB drive was connected, and the files were recovered from the USB.
   • CThe files were never on the USB drive because the Recycle Bin is empty.
   • DThe files were modified by a malware infection, not by the user.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   You are manually reviewing a forensic image and need to recover a deleted PDF file that was likely fragmented across multiple clusters. Which manual technique is most likely to succeed?

   • AUse a carving tool that supports fragmented file carving and manually validate the recovered file.
   • BSearch the file system journal for records of the file's writes.
   • CExamine the MFT entry for the file to recover its cluster list.
   • DPerform a string search for '%PDF' in unallocated space and manually extract data from that point.
   Reveal Solution Discussion Select an answer first