Windows Artifact Analysis GCFA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An incident responder has a memory image and a disk image from a compromised Windows system. The memory image shows a suspicious process running, but the process executable is not present on the disk image. Which conclusion is most defensible?

   • AThe process is likely a system process because it is not on disk
   • BThe process must be a kernel-mode rootkit because it is not on disk
   • CThe process may have been injected into another process, or the executable was deleted after loading, so the memory image is the primary source for analysis
   • DThe process is a false positive because the executable is not on disk
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An analyst is investigating a Windows 10 workstation where a user is suspected of running a portable application from a USB drive. The analyst has access to the user's NTUSER.DAT hive and the C:\Windows\Prefetch folder. Which combination of registry keys and Prefetch metadata would most strongly support the conclusion that the portable application was executed from the USB drive?

   • AUserAssist key under NTUSER.DAT showing the application name, and the Prefetch file's volume serial number matching the USB drive's serial number.
   • BAppCompatFlags\Run key under NTUSER.DAT showing the application path, and the Prefetch file's file size being larger than 100 KB.
   • CRunMRU key under NTUSER.DAT showing the application path, and the Prefetch file's last run time matching the user's logon time.
   • DMuiCache key under NTUSER.DAT showing the application path, and the Prefetch file's run count exceeding 10.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is it important to correlate memory artifacts with on-disk Windows artifacts during a forensic investigation?

   • AMemory artifacts are more reliable than disk artifacts
   • BMemory artifacts are the only source of user activity
   • CMemory artifacts can provide evidence of running processes and network connections that may not be present in on-disk artifacts
   • DMemory artifacts can be used to recover deleted files from the disk
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A forensic analyst is investigating a Windows 10 system where a user is suspected of deleting incriminating files. The analyst has access to the system's Volume Shadow Copies, the $MFT, and the USN journal. The analyst needs to recover the deleted files and determine when they were deleted. Which approach would be most effective?

   • AParse the $MFT to locate the deleted file records and recover the data clusters directly from the disk.
   • BUse the Prefetch folder to identify when the user last accessed the files and then search for them in the browser cache.
   • CMount the Volume Shadow Copy that predates the deletion and recover the files from there, then use the USN journal to confirm the deletion time.
   • DUse the USN journal to identify the deletion time and then search the Recycle Bin for the files.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic examiner is triaging a Windows 10 system and needs to quickly identify recently executed programs and user logon activity. Which two artifacts should be prioritized?

   • AThe $MFT and the USN journal
   • BPrefetch files and the Security event log
   • CThumbnail caches and Jump Lists
   • DThe SYSTEM hive and the SAM hive
   Reveal Solution Discussion Select an answer first