Windows Artifact Analysis GCFA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which browser artifact is most likely to contain a record of URLs visited, search terms, and cached web content?

   • AThumbnail cache
   • BEvent logs
   • CBrowser history and cache files
   • DPrefetch files
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What type of Windows artifact is a .lnk file, and what is its primary forensic value?

   • AA cache file that stores thumbnails of images
   • BA shortcut file that can reveal the target file path and the last access time of the target
   • CA configuration file that stores system settings
   • DA log file that records all user keystrokes
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   During a Windows forensic examination, an analyst wants to identify which applications were executed on the system. Which Windows artifact is specifically designed to record program execution times and is commonly used for this purpose?

   • APrefetch files
   • BWindows Event Logs
   • CThumbnail cache
   • DNTFS $MFT
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What information is typically stored in a Windows Prefetch file that is valuable for forensic analysis?

   • AThe executable name, run count, and last run time
   • BThe contents of recently deleted files
   • CThe IP addresses of network connections
   • DThe user's browsing history and cookies
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An analyst is constructing a timeline for a malware infection. They have the following artifacts: Security event logs showing a logon at 10:00, Prefetch for the malware at 10:05, $MFT showing the malware file created at 10:04, and USN journal showing a file deletion at 10:06. Which sequence of events is most consistent?

   • AThe file deletion at 10:06 occurred before the malware execution at 10:05
   • BThe malware file was created at 10:04, but the logon at 10:00 is unrelated
   • CMalware executed at 10:05, then the user logged on at 10:00, which is impossible
   • DUser logged on at 10:00, malware file created at 10:04, malware executed at 10:05, and a file deleted at 10:06
   Reveal Solution Discussion Select an answer first