File and Program Analysis GCFE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An examiner is analyzing a Microsoft Outlook desktop client on a suspect's computer. The examiner finds an email in the Deleted Items folder that was sent to a known malicious address. The email's 'Sent Time' header shows 9:00 AM, and the user's Windows Event Logs show the user was logged on at that time. The examiner also finds that the email was deleted at 9:05 AM. Which conclusion is most defensible?

   • AThe user likely sent the email and then deleted it, indicating intentional concealment
   • BThe email's 'Sent Time' header is unreliable, so the email may not have been sent at 9:00 AM
   • CThe email was sent from a different device, and the user deleted it from this computer
   • DThe email was sent by an attacker, and the user deleted it after discovering it
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An incident responder is performing live response on a compromised Windows system. The responder needs to identify which processes are currently running and which DLLs they have loaded to spot potential injection. Which tool and technique would be most appropriate?

   • AUse Windows Performance Monitor to track process activity over time
   • BUse the 'tasklist /m' command to list processes and their associated modules
   • CUse a memory acquisition tool to capture RAM and analyze it offline with Volatility
   • DUse Sysinternals Process Explorer to view running processes and their loaded DLLs in real-time
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An examiner is analyzing a USB drive that was used to transfer files between a Windows system and a Linux system. The drive is formatted with NTFS. The examiner finds a file that was deleted, but the MFT entry is still present. Which aspect of NTFS allows the examiner to recover the file's metadata even after deletion?

   • AThe MFT entry remains allocated until the file is overwritten, preserving metadata like timestamps and file size
   • BNTFS creates a backup copy of every file in the $LogFile, allowing full recovery
   • CThe file's content is stored in the MFT itself, so deletion only removes the directory entry
   • DThe file's data is immediately moved to the Recycle Bin, preserving the original file structure
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   During a forensic examination of a Windows 10 system, you need to identify the file system that is most commonly used on the system drive. Which file system is typically found on the C: volume of a modern Windows system?

   • AAPFS
   • BFAT32
   • Cext4
   • DNTFS
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An examiner is reviewing files on a suspect's external drive and finds a file named 'invoice.pdf'. The file's header bytes are 4D 5A 90 00, and the file extension is .pdf. The examiner also notes the file's creation time is 3 months before the drive was purchased. What is the most appropriate conclusion and next step?

   • AThe file is a PDF with a corrupted header; the examiner should attempt to repair the header to view the content
   • BThe file is a legitimate PDF that was renamed; the examiner should change the extension back to .exe and run it
   • CThe file is likely a Windows executable disguised as a PDF; the examiner should analyze it as a potential malicious program
   • DThe file's creation time anomaly indicates it was copied from another system; the examiner should focus on the file's origin
   Reveal Solution Discussion Select an answer first