Forensic Artifact Techniques GCFE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An examiner is analyzing a Windows 10 system and finds that the user has been using a portable application (e.g., a USB-based web browser). The examiner needs to determine which websites the user visited using this portable browser. The system has no browser history for the portable browser. Which of the following is the BEST approach to recover this information?

   • AExamine the system's DNS cache and network logs.
   • BExamine the Windows Prefetch files for the portable browser executable.
   • CExamine the Windows Search index (Windows.edb) for browser history.
   • DExamine the Windows 10 Timeline (ActivitiesCache.db) for browser activity.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An examiner is preserving evidence from a Windows 10 system that is part of a criminal investigation. The system has been seized and is in the examiner's custody. What is the most important step to maintain the chain of custody?

   • ADocument every person who has access to the system and when
   • BUse a write-blocker when accessing the system
   • CCreate a forensic image of the system immediately
   • DKeep the system in a locked room with limited access
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An examiner is analyzing a Windows 10 system and finds that the user has used a private browsing mode. Which artifact is most likely to still contain evidence of the user's web activity?

   • AThe Recycle Bin
   • BThe DNS cache
   • CThe Windows Event Log
   • DThe browser's history file
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An examiner needs to acquire the RAM of a running Windows 10 system to capture volatile evidence. Which method is most appropriate?

   • ATake a screenshot of the desktop to capture what is on the screen
   • BCopy the pagefile.sys file from the system drive
   • CPerform a memory dump using a trusted tool like WinPmem or FTK Imager
   • DUse the Windows 'tasklist' command to list running processes
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic examiner is responding to a suspected data exfiltration incident involving a Windows 10 workstation. The workstation is currently running, and the user is still logged in. The examiner needs to collect the most volatile data first while preserving the integrity of the evidence. Which of the following actions should the examiner perform FIRST?

   • ACapture the contents of physical memory using a tool like FTK Imager or WinPmem.
   • BRun a network capture tool to record live traffic.
   • CRecord the current date and time from the system clock.
   • DCreate a forensic image of the hard drive using a write-blocker.
   Reveal Solution Discussion Select an answer first