During a forensic examination, an examiner discovers a critical file that may be deleted soon by the system's automatic cleanup. To preserve the file's evidentiary value, what is the most appropriate action?

Move the file to a different folder on the same drive

Copy the file to a network share and then delete the original

Create a cryptographic hash of the file and document it in the report

Make a bit-for-bit forensic image of the entire volume or device

An examiner is documenting the analysis of a suspect's web browsing history. Which documentation practice is most important for ensuring the findings are admissible in court?

Including the exact commands and tools used, along with the date and time of the analysis

Summarizing the findings in a brief paragraph without technical details

Recording the examiner's personal interpretation of the browsing history

Storing the analysis notes only in the examiner's personal notebook

Which of the following is a forensic artifact that primarily contains information about a user's web browsing history?

The browser's history database (e.g., History.db in Firefox)

During a forensic examination, an examiner finds a file that is crucial to the case. To ensure the file's integrity is maintained for legal proceedings, what should the examiner do FIRST?

Delete the file to prevent tampering

Copy the file to a different location on the same drive

Create a cryptographic hash of the file and record it

Open the file to view its contents

GIAC Certified Forensic Examiner

Domain 2Objective 1

Forensic Artifact Techniques GCFE Practice Questions (Page 7)

Part of the Forensic Artifact Techniques domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 31–35

31application · medium
During a forensic examination, an examiner discovers a critical file that may be deleted soon by the system's automatic cleanup. To preserve the file's evidentiary value, what is the most appropriate action?
Select an answer first
32application · medium
An examiner is documenting the analysis of a suspect's web browsing history. Which documentation practice is most important for ensuring the findings are admissible in court?
Select an answer first
33foundation · easy
Which of the following is a forensic artifact that primarily contains information about a user's web browsing history?
Select an answer first
34foundation · easy
Which artifact would you analyze to determine the last time a specific user logged into a Windows system?
Select an answer first
35application · medium
During a forensic examination, an examiner finds a file that is crucial to the case. To ensure the file's integrity is maintained for legal proceedings, what should the examiner do FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.