An examiner is manually searching a live Windows system for evidence of a specific file. Which technique is most appropriate for a systematic manual search?

Running a full disk imaging tool to create a forensic copy

Searching the Recycle Bin and temporary folders only

Using the Windows search function to look for the file name and then examining the results

Browsing the file system in a logical order, such as user profiles and common data locations, while documenting findings

Which combination of artifacts would be most useful to correlate to show that a user downloaded a file and then opened it?

Browser history and recent files

File system metadata and network logs

You have found a suspicious executable on a forensic image. You need to determine if the user intentionally ran it or if it was executed by malware. Which combination of manual findings would best support the conclusion of intentional execution?

The executable has a valid digital signature from a reputable vendor.

The executable is located in the user's Downloads folder, and the user's browser history shows a download from a known software site.

The executable's creation time matches the system boot time.

The executable's access time is recent and the user was logged in at that time.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 2

Manually Finding Data GBFA Practice Questions (Page 9)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 41–44

41foundation · easy
An examiner is manually searching a live Windows system for evidence of a specific file. Which technique is most appropriate for a systematic manual search?
Select an answer first
42foundation · easy
Which combination of artifacts would be most useful to correlate to show that a user downloaded a file and then opened it?
Select an answer first
43foundation · easy
Which of the following is a common forensic artifact that can reveal a user's web browsing activity?
Select an answer first
44expert · hard
You have found a suspicious executable on a forensic image. You need to determine if the user intentionally ran it or if it was executed by malware. Which combination of manual findings would best support the conclusion of intentional execution?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Manually Finding Data GBFA Practice Questions (Page 9)

Questions 41–44

An examiner is manually searching a live Windows system for evidence of a specific file. Which technique is most appropriate for a systematic manual search?

Which combination of artifacts would be most useful to correlate to show that a user downloaded a file and then opened it?

Which of the following is a common forensic artifact that can reveal a user's web browsing activity?

You have found a suspicious executable on a forensic image. You need to determine if the user intentionally ran it or if it was executed by malware. Which combination of manual findings would best support the conclusion of intentional execution?

Keep studying — Triage and Manual Analysis