An examiner is documenting the analysis of a suspect's social media activity. The examiner used a commercial tool to extract data from the suspect's phone. What is the most important information to include in the documentation?

The suspect's phone number and service provider

The tool's name, version, and the extraction method used

The number of social media posts extracted

The examiner's personal interpretation of the social media posts

An examiner is investigating a Windows 10 workstation for evidence of unauthorized file access. The user's NTFS $MFT shows that a sensitive document was last modified at 14:32, but the user claims they only opened it, never edited it. Which artifact should the examiner analyze to verify whether the file's content was actually changed?

The file's $FN (file name) attribute timestamps

The file's $DATA attribute and its resident/non-resident flag

The file's $STANDARD_INFORMATION timestamps

The NTFS $LogFile and $UsnJrnl records

An examiner is collecting evidence from a Windows system that is part of a network. The examiner needs to preserve the evidence in a way that maintains its integrity and allows for later verification. Which of the following is the BEST practice for preserving the evidence?

Create a forensic image of the hard drive and compute a SHA-256 hash of the image.

Use Windows Backup to create a system image.

Take a screenshot of the desktop and save it to a network share.

Copy the entire hard drive to an external USB drive using standard copy commands.

An examiner is collecting evidence from a Windows system that is part of a domain. The examiner needs to acquire the system's registry hives to analyze user activity. Which of the following is the BEST method to acquire the registry hives?

Use the System Restore feature to create a restore point.

Copy the hive files directly from the Windows directory.

Use the Windows Registry Editor (regedit) to export the hives.

Use a forensic tool to copy the registry hives while the system is running.

GIAC Certified Forensic Examiner

Domain 2Objective 1

Forensic Artifact Techniques GCFE Practice Questions (Page 8)

Part of the Forensic Artifact Techniques domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 36–40

36expert · hard
An examiner is documenting the analysis of a suspect's social media activity. The examiner used a commercial tool to extract data from the suspect's phone. What is the most important information to include in the documentation?
Select an answer first
37application · medium
An examiner is investigating a Windows 10 workstation for evidence of unauthorized file access. The user's NTFS $MFT shows that a sensitive document was last modified at 14:32, but the user claims they only opened it, never edited it. Which artifact should the examiner analyze to verify whether the file's content was actually changed?
Select an answer first
38application · medium
An examiner is collecting evidence from a Windows system that is part of a network. The examiner needs to preserve the evidence in a way that maintains its integrity and allows for later verification. Which of the following is the BEST practice for preserving the evidence?
Select an answer first
39foundation · easy
When analyzing a Windows system's Registry, which hive file would you examine to find user-specific application usage and recently accessed documents?
Select an answer first
40application · medium
An examiner is collecting evidence from a Windows system that is part of a domain. The examiner needs to acquire the system's registry hives to analyze user activity. Which of the following is the BEST method to acquire the registry hives?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Forensic Artifact Techniques GCFE Practice Questions (Page 8)

Questions 36–40

An examiner is documenting the analysis of a suspect's social media activity. The examiner used a commercial tool to extract data from the suspect's phone. What is the most important information to include in the documentation?

An examiner is collecting evidence from a Windows system that is part of a network. The examiner needs to preserve the evidence in a way that maintains its integrity and allows for later verification. Which of the following is the BEST practice for preserving the evidence?

When analyzing a Windows system's Registry, which hive file would you examine to find user-specific application usage and recently accessed documents?

An examiner is collecting evidence from a Windows system that is part of a domain. The examiner needs to acquire the system's registry hives to analyze user activity. Which of the following is the BEST method to acquire the registry hives?

Keep studying — Forensic Artifact Techniques