An examiner is responding to an incident where a user may have downloaded malware from a phishing email. The examiner needs to acquire the email and its attachments from the user's Outlook client. Which of the following is the BEST method to preserve the email evidence?

Take a screenshot of the email in Outlook.

Print the email and attachments.

Copy the email to a shared network folder.

Export the email as a .msg file and compute a hash of the file.

An examiner is investigating a Windows 10 system for evidence of USB device usage. Which artifact is most useful for identifying the last time a specific USB drive was connected?

The NTFS $MFT entries for the USB drive's files

The Windows Event Log (Application log)

The Windows Registry key SYSTEM\CurrentControlSet\Enum\USBSTOR

An examiner is analyzing a Windows 10 system and needs to determine which user accounts were used to log on to the system over the past week. Which artifact should the examiner prioritize?

The Windows Search database (Windows.edb)

The Prefetch files in C:\Windows\Prefetch

The $MFT entries for the NTUSER.DAT files

The Windows Event Log (Security log) with logon event IDs 4624 and 4625

An examiner is analyzing a Windows 10 system and finds that the user's browser history has been cleared. However, the examiner needs to determine which websites were visited. Which combination of artifacts would be most useful?

The Windows Event Log and the $MFT

The Windows Search database and the Recycle Bin

The Registry and the pagefile.sys

Prefetch files and the DNS cache

An examiner is documenting the analysis of a hard drive image. The examiner needs to include a visual representation of the directory structure and file metadata to support the report. Which of the following is the BEST method to document this information?

Generate a file listing with hashes and timestamps and include it as an appendix.

Write a narrative description of the directory structure in the report.

Take screenshots of the forensic tool's GUI showing the directory tree.

Create a timeline of file system events using a tool like Plaso.

GIAC Certified Forensic Examiner

Domain 2Objective 1

Forensic Artifact Techniques GCFE Practice Questions (Page 4)

Part of the Forensic Artifact Techniques domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 16–20

16application · medium
An examiner is responding to an incident where a user may have downloaded malware from a phishing email. The examiner needs to acquire the email and its attachments from the user's Outlook client. Which of the following is the BEST method to preserve the email evidence?
Select an answer first
17application · medium
An examiner is investigating a Windows 10 system for evidence of USB device usage. Which artifact is most useful for identifying the last time a specific USB drive was connected?
Select an answer first
18application · medium
An examiner is analyzing a Windows 10 system and needs to determine which user accounts were used to log on to the system over the past week. Which artifact should the examiner prioritize?
Select an answer first
19expert · hard
An examiner is analyzing a Windows 10 system and finds that the user's browser history has been cleared. However, the examiner needs to determine which websites were visited. Which combination of artifacts would be most useful?
Select an answer first
20application · medium
An examiner is documenting the analysis of a hard drive image. The examiner needs to include a visual representation of the directory structure and file metadata to support the report. Which of the following is the BEST method to document this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.