Which tool or method is commonly used to access Volume Shadow Copies on a forensic image?

Mounting the image and using vssadmin or specialized forensic tools like ShadowCopyView

A forensic analyst is investigating a Windows 10 system where a user is suspected of running a portable application from a USB drive. The analyst has the user's NTUSER.DAT hive and the Prefetch folder. The UserAssist key shows the application name but not the full path. The Prefetch file for the application shows a volume serial number that does not match the system drive. Which conclusion is most defensible?

The application was executed from the system drive because UserAssist does not store full paths.

The application was executed from a network share because Prefetch volume serial numbers are not used for network paths.

The application was likely executed from a volume other than the system drive, possibly the USB drive, but the exact path cannot be confirmed without additional artifacts.

The application was definitely executed from the USB drive because the Prefetch volume serial number does not match the system drive.

GIAC Certified Forensic Analyst

Domain 4Objective 1

Windows Artifact Analysis GCFA Practice Questions (Page 1)

Part of the Windows Artifact Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

Questions 1–5

1foundation · easy
Which registry hive contains the user-specific data such as desktop settings, recently accessed documents, and application preferences for a particular user account?
Select an answer first
2foundation · easy
Which tool or method is commonly used to access Volume Shadow Copies on a forensic image?
Select an answer first
3foundation · easy
Which Windows artifact stores thumbnail images of files and folders for display in Windows Explorer, and can reveal that a user viewed certain images or documents?
Select an answer first
4expert · hard
A forensic analyst is investigating a Windows 10 system where a user is suspected of running a portable application from a USB drive. The analyst has the user's NTUSER.DAT hive and the Prefetch folder. The UserAssist key shows the application name but not the full path. The Prefetch file for the application shows a volume serial number that does not match the system drive. Which conclusion is most defensible?
Select an answer first
5foundation · easy
Which Windows artifact category is most useful for revealing user-specific configuration, recently accessed documents, and installed programs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Windows Artifact Analysis GCFA Practice Questions (Page 1)

Questions 1–5

Which registry hive contains the user-specific data such as desktop settings, recently accessed documents, and application preferences for a particular user account?

Which tool or method is commonly used to access Volume Shadow Copies on a forensic image?

Which Windows artifact stores thumbnail images of files and folders for display in Windows Explorer, and can reveal that a user viewed certain images or documents?

Which Windows artifact category is most useful for revealing user-specific configuration, recently accessed documents, and installed programs?

Keep studying — Windows Artifact Analysis