An analyst is building a timeline for a Windows 10 system where a user is suspected of exfiltrating data. The analyst has the Security event log, the user's NTUSER.DAT hive, the Prefetch folder, and the $MFT. The analyst needs to determine the order of the following events: user logon, application execution, file access, and file deletion. Which approach would produce the most accurate timeline?

Extract timestamps from all artifacts and merge them into a single timeline, using the Security log for logons, UserAssist and Prefetch for executions, and $MFT/USN for file events.

Use only the $MFT to determine all events, as it records file access, creation, and deletion times.

Use only the Prefetch folder to determine all events, as it records program executions and file accesses.

Use only the Security event log to determine all events, as it records logons, process creation, and file access.

An analyst is investigating a Windows 8.1 system where a user is suspected of viewing sensitive images. The analyst has access to the user's AppData\Local\Microsoft\Windows\Explorer folder and the user's Recent folder. Which artifact would provide the most direct evidence that the user viewed the images?

LNK files in the Recent folder pointing to the image files.

Thumbnail cache files (thumbcache_*.db) containing thumbnails of the sensitive images.

Jump Lists for the photo viewer application showing the image file names.

Prefetch files for the photo viewer application showing a run count.

GIAC Certified Forensic Analyst

Domain 4Objective 1

Windows Artifact Analysis GCFA Practice Questions (Page 6)

Part of the Windows Artifact Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

Questions 26–30

26foundation · easy
Which Event ID is commonly associated with successful logon events in the Windows Security log?
Select an answer first
27expert · hard
An analyst is building a timeline for a Windows 10 system where a user is suspected of exfiltrating data. The analyst has the Security event log, the user's NTUSER.DAT hive, the Prefetch folder, and the $MFT. The analyst needs to determine the order of the following events: user logon, application execution, file access, and file deletion. Which approach would produce the most accurate timeline?
Select an answer first
28foundation · easy
Which NTFS structure is the master index that contains a record for every file and directory on the volume, including metadata such as timestamps, file size, and data attribute locations?
Select an answer first
29application · medium
An analyst is investigating a Windows 8.1 system where a user is suspected of viewing sensitive images. The analyst has access to the user's AppData\Local\Microsoft\Windows\Explorer folder and the user's Recent folder. Which artifact would provide the most direct evidence that the user viewed the images?
Select an answer first
30foundation · easy
Which NTFS artifact is a change journal that records modifications to files and directories, such as creation, deletion, and data changes, and can be used to track file activity over time?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Windows Artifact Analysis GCFA Practice Questions (Page 6)

Questions 26–30

Which Event ID is commonly associated with successful logon events in the Windows Security log?

Which NTFS structure is the master index that contains a record for every file and directory on the volume, including metadata such as timestamps, file size, and data attribute locations?

Which NTFS artifact is a change journal that records modifications to files and directories, such as creation, deletion, and data changes, and can be used to track file activity over time?

Keep studying — Windows Artifact Analysis