Forensic Artifact Techniques GCFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During an investigation of a Windows 10 system, an examiner finds a USB device was used to copy sensitive documents. The examiner needs to determine the exact time the USB device was first connected and the last time it was used. Which forensic artifact should the examiner examine to answer this question?

   • AWindows Registry (SetupAPI.log and USBSTOR keys)
   • BWindows Event Logs (Security log)
   • CWindows Thumbnail cache
   • DWindows Prefetch files
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic examiner is investigating a case of intellectual property theft. The suspect used a Windows 10 laptop to access a company file server and then copied files to a USB drive. Which artifact would be most useful to prove the file copy operation?

   • AThe $UsnJrnl (Update Sequence Number Journal) on the laptop
   • BThe Windows Prefetch files for the file explorer process
   • CThe Windows Search database for recently indexed files
   • DThe Windows Event Log for application errors
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is the most appropriate method to preserve a forensic artifact that exists only in RAM?

   • ATake a photograph of the screen showing the RAM contents
   • BCopy the RAM contents to a file on the hard drive
   • CReboot the system to save RAM contents to the pagefile
   • DUse a memory acquisition tool to dump RAM to an external device
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During a Windows forensic examination, which of the following is classified as a forensic artifact that can reveal user activity?

   • AThe Master Boot Record (MBR)
   • BThe system pagefile
   • CThe Windows Prefetch files
   • DThe NTFS Master File Table (MFT)
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An examiner is preparing a report for a case involving alleged fraud. The examiner has analyzed a Windows 10 system and found evidence of deleted files and web browsing activity. The examiner needs to present the findings in a clear and defensible manner. Which of the following is the BEST way to present the findings?

   • AProvide only the conclusions and recommendations.
   • BInclude a timeline of events with supporting artifacts and hash values.
   • CProvide a detailed narrative of the analysis process and findings.
   • DInclude screenshots of the forensic tool's interface.
   Reveal Solution Discussion Select an answer first