An analyst is investigating a Windows 10 system where a user is suspected of running a hacking tool. The tool was deleted after use. Which artifact would most likely still contain evidence of the tool's execution?

The Prefetch file for the tool's executable name

The $MFT entry for the deleted tool

During a forensic examination, an analyst wants to determine which applications were run on a Windows 10 system and when they were first executed. The system has Prefetch enabled. Which artifact set provides the most reliable execution history?

The user's NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist key

Prefetch files in C:\Windows\Prefetch, parsing the run time and run count from each .pf file

The SYSTEM hive's ControlSet001\Control\Session Manager\BootExecute value

The Application event log entries with Event ID 1000

A forensic analyst is investigating a data exfiltration incident. The suspect deleted a critical file and then emptied the Recycle Bin. The system has Volume Shadow Copies enabled, but the analyst must decide whether to recover the file from a shadow copy or from unallocated space. Which consideration is most important?

Shadow copies are only available on servers, not workstations

The shadow copy may contain the file if it was created before the deletion, while unallocated space recovery depends on whether the clusters were overwritten

The $MFT entry for the deleted file is the best source for recovery

Unallocated space recovery is always faster and more reliable than shadow copies

An analyst is building a timeline of a security incident. They have collected the following artifacts: Security event logs, $MFT timestamps, USN journal entries, and Prefetch files. Which approach is most effective for constructing a coherent timeline?

Use only the Security event logs because they are the most reliable source

Normalize all timestamps to a common time zone and sort events chronologically, correlating across artifact types

Sort events by the $MFT timestamps only, as they are the most accurate

Combine all artifacts into a single spreadsheet without adjusting time zones

GIAC Certified Forensic Analyst

Domain 4Objective 1

Windows Artifact Analysis GCFA Practice Questions (Page 2)

Part of the Windows Artifact Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

Questions 6–10

6application · medium
An analyst is investigating a Windows 10 system where a user is suspected of running a hacking tool. The tool was deleted after use. Which artifact would most likely still contain evidence of the tool's execution?
Select an answer first
7foundation · easy
Which Windows feature is the successor to Prefetch and is used to optimize boot times by analyzing boot-time disk access patterns?
Select an answer first
8application · medium
During a forensic examination, an analyst wants to determine which applications were run on a Windows 10 system and when they were first executed. The system has Prefetch enabled. Which artifact set provides the most reliable execution history?
Select an answer first
9expert · hard
A forensic analyst is investigating a data exfiltration incident. The suspect deleted a critical file and then emptied the Recycle Bin. The system has Volume Shadow Copies enabled, but the analyst must decide whether to recover the file from a shadow copy or from unallocated space. Which consideration is most important?
Select an answer first
10application · medium
An analyst is building a timeline of a security incident. They have collected the following artifacts: Security event logs, $MFT timestamps, USN journal entries, and Prefetch files. Which approach is most effective for constructing a coherent timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.