A user is suspected of exfiltrating sensitive documents via a web-based email service. The examiner has the user's Windows 10 laptop and needs to reconstruct the user's web activity. The examiner finds that the user primarily uses Google Chrome. Which combination of artifacts would provide the most comprehensive view of the user's web-based email activity?

The user's NTUSER.DAT registry hive and the Windows Prefetch folder

The system's Event Logs and the user's Recent Files list

The browser's Extensions folder and the user's Bookmarks file

Chrome's History database, Cache folder, and Cookies database

GIAC Certified Forensic Examiner

Domain 5Objective 1

File and Program Analysis GCFE Practice Questions (Page 9)

Part of the File and Program Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

Questions 41–41

41application · medium
A user is suspected of exfiltrating sensitive documents via a web-based email service. The examiner has the user's Windows 10 laptop and needs to reconstruct the user's web activity. The examiner finds that the user primarily uses Google Chrome. Which combination of artifacts would provide the most comprehensive view of the user's web-based email activity?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

File and Program Analysis GCFE Practice Questions (Page 9)

Questions 41–41

Keep studying — File and Program Analysis