A forensic examiner is investigating a case involving suspicious communications. The suspect used a desktop email client (e.g., Outlook) and also a messaging app. Which artifact would be most useful to correlate the timing of a specific email with a chat message?

The email client's prefetch file and the messaging app's prefetch file.

The email's 'Sent' timestamp from the email client's mailbox and the messaging app's local database timestamp for the chat message.

The email's file metadata (creation time) and the messaging app's installation date.

The system's event logs showing when the email client and messaging app were launched.

A malware analyst suspects that a malicious program is set to run automatically every time the system starts, even before any user logs in. Which persistence mechanism would allow this?

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Scheduled task with 'Run only when user is logged on'

An examiner is investigating a user's web activity on a Windows 10 system. The user is suspected of using a private browsing mode to access illegal content. The examiner finds that the user's browser history is empty, but the system's pagefile.sys contains fragments of web pages. Which conclusion is most defensible?

The user did not use private browsing, and the pagefile is the only source of evidence

The user's browser history was cleared, and the pagefile contains unrelated data

The user's browser history was cleared, and the pagefile is not a reliable source of evidence

The user likely used private browsing, and the pagefile may contain remnants of the web pages visited

GIAC Certified Forensic Examiner

Domain 5Objective 1

File and Program Analysis GCFE Practice Questions (Page 1)

Part of the File and Program Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

Questions 1–5

1foundation · easy
You are investigating a case involving email communications. Which file format is commonly used by Microsoft Outlook to store email messages and can be found on the local system?
Select an answer first
2foundation · easy
You are investigating a system and need to find evidence that a user opened a specific document from a USB drive. Which Windows artifact is most likely to contain this information?
Select an answer first
3application · medium
A forensic examiner is investigating a case involving suspicious communications. The suspect used a desktop email client (e.g., Outlook) and also a messaging app. Which artifact would be most useful to correlate the timing of a specific email with a chat message?
Select an answer first
4foundation · easy
A malware analyst suspects that a malicious program is set to run automatically every time the system starts, even before any user logs in. Which persistence mechanism would allow this?
Select an answer first
5expert · hard
An examiner is investigating a user's web activity on a Windows 10 system. The user is suspected of using a private browsing mode to access illegal content. The examiner finds that the user's browser history is empty, but the system's pagefile.sys contains fragments of web pages. Which conclusion is most defensible?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

File and Program Analysis GCFE Practice Questions (Page 1)

Questions 1–5

You are investigating a case involving email communications. Which file format is commonly used by Microsoft Outlook to store email messages and can be found on the local system?

You are investigating a system and need to find evidence that a user opened a specific document from a USB drive. Which Windows artifact is most likely to contain this information?

A forensic examiner is investigating a case involving suspicious communications. The suspect used a desktop email client (e.g., Outlook) and also a messaging app. Which artifact would be most useful to correlate the timing of a specific email with a chat message?

A malware analyst suspects that a malicious program is set to run automatically every time the system starts, even before any user logs in. Which persistence mechanism would allow this?

Keep studying — File and Program Analysis