Which of the following is the correct procedure for acquiring a forensic image of a live Windows system to preserve volatile data?

Unplug the network cable and then image the hard drive

Power off the system immediately and then image the hard drive

Collect volatile data first (e.g., RAM, network connections) and then image the hard drive

Image the hard drive first and then collect volatile data

An examiner is analyzing a Windows 10 system to determine what applications were run by the user. Which artifact is most reliable for this purpose?

The Windows Event Log (System log)

The NTFS $MFT entries for executable files

Which of the following is the most important element to include in a forensic examination report?

The suspect's social media profiles

The exact cost of the forensic examination

The examiner's personal opinion about the suspect's guilt

A detailed description of the tools and methods used

An examiner is preparing a report for a case involving email evidence. Which element is essential to include in the documentation?

A summary of the case without technical details

The exact file paths and hashes of the email artifacts

The examiner's personal opinion about the suspect's intent

Only the conclusions drawn from the analysis

An examiner is investigating a Windows 10 system for evidence of file downloads from the internet. The user claims they never downloaded any files. Which artifact would be most useful to prove or disprove this claim?

The Windows Search database and the Recycle Bin

The browser's download history and the $MFT for the Downloads folder

The Registry and the pagefile.sys

The Windows Event Log and the Prefetch files

GIAC Certified Forensic Examiner

Domain 2Objective 1

Forensic Artifact Techniques GCFE Practice Questions (Page 3)

Part of the Forensic Artifact Techniques domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 11–15

11foundation · easy
Which of the following is the correct procedure for acquiring a forensic image of a live Windows system to preserve volatile data?
Select an answer first
12application · medium
An examiner is analyzing a Windows 10 system to determine what applications were run by the user. Which artifact is most reliable for this purpose?
Select an answer first
13foundation · easy
Which of the following is the most important element to include in a forensic examination report?
Select an answer first
14application · medium
An examiner is preparing a report for a case involving email evidence. Which element is essential to include in the documentation?
Select an answer first
15expert · hard
An examiner is investigating a Windows 10 system for evidence of file downloads from the internet. The user claims they never downloaded any files. Which artifact would be most useful to prove or disprove this claim?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.