A forensic analyst is investigating a ransomware incident where files were encrypted and then deleted. The system has Volume Shadow Copies enabled. Which step should the analyst take to recover the original files?

Use the USN journal to identify the encryption operation and then reverse it

Mount the latest Volume Shadow Copy and extract the original files from before the encryption event

Check the Prefetch files for the ransomware executable to identify the encryption routine

Parse the $MFT to recover the deleted file entries and reconstruct the files

What is the primary purpose of timeline construction in Windows forensic analysis?

To determine the physical location of the hard drive

To identify the owner of a computer

To arrange events from multiple artifacts in chronological order to reconstruct the sequence of system and user activity

To recover deleted files from unallocated space

In the Windows registry, which key is commonly used to track programs that run automatically at system startup?

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Control Panel\Desktop

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

An analyst is investigating a Windows 10 system where a user allegedly deleted a file. The analyst needs to determine when the file was deleted and whether it was permanently removed or moved to the Recycle Bin. Which combination of artifacts would provide the most useful information?

The Volume Shadow Copies and the System event log for disk errors.

The Recycle Bin $I and $R files and the Prefetch folder for the file's associated application.

The Security event log for object access auditing and the browser history.

The $MFT entry for the file (if present) and the USN journal for delete records.

GIAC Certified Forensic Analyst

Domain 4Objective 1

Windows Artifact Analysis GCFA Practice Questions (Page 3)

Part of the Windows Artifact Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

Questions 11–15

11application · medium
A forensic analyst is investigating a ransomware incident where files were encrypted and then deleted. The system has Volume Shadow Copies enabled. Which step should the analyst take to recover the original files?
Select an answer first
12foundation · easy
What is the primary purpose of timeline construction in Windows forensic analysis?
Select an answer first
13foundation · easy
In the Windows registry, which key is commonly used to track programs that run automatically at system startup?
Select an answer first
14foundation · easy
Which of the following is a common tool used to create a super timeline by aggregating multiple Windows artifacts?
Select an answer first
15application · medium
An analyst is investigating a Windows 10 system where a user allegedly deleted a file. The analyst needs to determine when the file was deleted and whether it was permanently removed or moved to the Recycle Bin. Which combination of artifacts would provide the most useful information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.