A forensic examiner is planning to acquire data from a suspect's Google Drive account. The examiner has legal authority but the account is in a different country. Which consideration is most important for the acquisition?

The type of Google Drive account (personal vs. Workspace)

The size of the data to be acquired

The data residency laws of the country where the data is stored

An examiner finds a Google Drive folder on a shared Windows workstation. The folder contains files that were created under a user account that no longer exists. Which artifact would best help attribute the files to the original user?

The file's owner SID in the file system metadata

The folder's creation timestamp

An examiner is analyzing a Google Drive sync log from a user's Mac. The log shows a file was 'downloaded' at 14:32 and then 'deleted' at 14:35. The user claims they never saw the file. Which additional metadata would be MOST helpful to determine whether the deletion was initiated by the user or by another device?

The file's creation timestamp from the cloud metadata

The device ID and IP address associated with the deletion event

The user's browser history from the same time period

The file's SHA256 hash from the log

During a forensic examination of a Windows 10 laptop, the examiner finds a folder named 'OneDrive - Contoso' in the user's profile. The folder contains files that appear to be cached copies of cloud documents. Which local artifact would BEST help the examiner determine which Microsoft account was used to synchronize these files?

The Windows Prefetch files for OneDrive.exe

The NTFS $MFT timestamps of the cached files

The registry key HKCU\Software\Microsoft\OneDrive with the UserEmail value

The file names and extensions of the cached files

An organization is investigating a potential insider threat where an employee used a personal cloud storage account to exfiltrate data. The employee's company laptop is available, but the cloud provider is uncooperative. Which acquisition method would be MOST effective to obtain evidence of the exfiltration?

Forensically image the laptop and analyze the cloud storage client's cache and logs

Use network packet captures from the company firewall to reconstruct the upload

Wait for the cloud provider to respond to a preservation request

Request the employee's cloud account password from HR

GIAC Certified Forensic Examiner

Domain 6Objective 2

Cloud Storage Analysis GCFE Practice Questions (Page 4)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

Questions 16–20

16expert · hard
A forensic examiner is planning to acquire data from a suspect's Google Drive account. The examiner has legal authority but the account is in a different country. Which consideration is most important for the acquisition?
Select an answer first
17application · medium
An examiner finds a Google Drive folder on a shared Windows workstation. The folder contains files that were created under a user account that no longer exists. Which artifact would best help attribute the files to the original user?
Select an answer first
18application · medium
An examiner is analyzing a Google Drive sync log from a user's Mac. The log shows a file was 'downloaded' at 14:32 and then 'deleted' at 14:35. The user claims they never saw the file. Which additional metadata would be MOST helpful to determine whether the deletion was initiated by the user or by another device?
Select an answer first
19application · medium
During a forensic examination of a Windows 10 laptop, the examiner finds a folder named 'OneDrive - Contoso' in the user's profile. The folder contains files that appear to be cached copies of cloud documents. Which local artifact would BEST help the examiner determine which Microsoft account was used to synchronize these files?
Select an answer first
20application · medium
An organization is investigating a potential insider threat where an employee used a personal cloud storage account to exfiltrate data. The employee's company laptop is available, but the cloud provider is uncooperative. Which acquisition method would be MOST effective to obtain evidence of the exfiltration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Cloud Storage Analysis GCFE Practice Questions (Page 4)

Questions 16–20

A forensic examiner is planning to acquire data from a suspect's Google Drive account. The examiner has legal authority but the account is in a different country. Which consideration is most important for the acquisition?

An examiner finds a Google Drive folder on a shared Windows workstation. The folder contains files that were created under a user account that no longer exists. Which artifact would best help attribute the files to the original user?

Keep studying — User and Cloud Artifacts