An analyst is investigating a Windows 10 system where a user is suspected of viewing sensitive images from a network share. The analyst has the thumbnail cache, the user's Jump Lists, and the Security event log. The thumbnail cache contains thumbnails of the sensitive images, but the Jump Lists do not show any entries for the image viewer. Which conclusion is most defensible?

The images were not viewed because Jump Lists do not show any entries.

The images were likely viewed in Explorer, which generated thumbnails, but the viewer application may not have been used, so Jump Lists would not show entries.

The images were accessed from a local drive because network shares do not generate thumbnail caches.

The images were definitely opened in a viewer because thumbnails are only generated when an image is opened.

An analyst is building a timeline of user activity on a Windows 10 system. The analyst has collected the Security event log, the user's NTUSER.DAT hive, and the Prefetch folder. Which sequence of steps would produce the most accurate timeline of user logons and program executions?

Use only the Prefetch folder to determine program executions and then use the $MFT to determine user logons.

Use only the Security event log to identify logons and then use the System event log to identify program executions.

Extract logon events from the Security log, extract UserAssist entries from NTUSER.DAT, extract Prefetch last-run times, and merge all timestamps into a single timeline.

Extract UserAssist entries from NTUSER.DAT and then use the browser history to determine logon times.

An analyst is investigating a case involving alleged viewing of illicit images on a Windows 10 system. The images were deleted from the filesystem, but the analyst wants to determine if they were ever displayed. Which artifact would be most useful?

The Prefetch file for the image viewer application

The $MFT entry for the deleted image files

The user's browser history from the default browser

The thumbnail cache files (e.g., thumbcache_*.db) in the user's AppData\Local\Microsoft\Windows\Explorer folder

An incident responder has captured a memory image from a compromised Windows system. They also have the disk image. Which approach best correlates volatile and non-volatile artifacts to identify the malicious process?

Extract the process list from memory and match executable paths to Prefetch files and the $MFT

Analyze the Security event log for process creation events and ignore memory

Use the registry hives from the disk image to identify autostart entries and assume those are malicious

Examine the USN journal for file creations and correlate with the system time

GIAC Certified Forensic Analyst

Domain 4Objective 1

Windows Artifact Analysis GCFA Practice Questions (Page 7)

Part of the Windows Artifact Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

10concepts

Questions 31–35

31expert · hard
An analyst is investigating a Windows 10 system where a user is suspected of viewing sensitive images from a network share. The analyst has the thumbnail cache, the user's Jump Lists, and the Security event log. The thumbnail cache contains thumbnails of the sensitive images, but the Jump Lists do not show any entries for the image viewer. Which conclusion is most defensible?
Select an answer first
32application · medium
An analyst is building a timeline of user activity on a Windows 10 system. The analyst has collected the Security event log, the user's NTUSER.DAT hive, and the Prefetch folder. Which sequence of steps would produce the most accurate timeline of user logons and program executions?
Select an answer first
33application · medium
An analyst is investigating a case involving alleged viewing of illicit images on a Windows 10 system. The images were deleted from the filesystem, but the analyst wants to determine if they were ever displayed. Which artifact would be most useful?
Select an answer first
34application · medium
An incident responder has captured a memory image from a compromised Windows system. They also have the disk image. Which approach best correlates volatile and non-volatile artifacts to identify the malicious process?
Select an answer first
35foundation · easy
Which Windows artifact is a list of recently opened documents and applications that is stored in the user's AppData directory and is often used to determine user activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.