An examiner is analyzing a Windows 10 system and finds a prefetch file for a program that was executed. What information can be derived from the prefetch file?

The program's installation date.

The network connections made by the program.

The user account that executed the program.

The last time the program was executed and the files it accessed during execution.

Which file system artifact is most useful for determining when a specific file was first created on an NTFS volume?

The $STANDARD_INFORMATION attribute's creation timestamp

The $BITMAP attribute's allocation status

The $FILE_NAME attribute's last access timestamp

The $DATA attribute's file size

A forensic team is planning the acquisition of a corporate laptop that may contain evidence of intellectual property theft. The laptop is currently in use by the suspect, and the company wants to minimize disruption. The laptop has a solid-state drive (SSD) with TRIM enabled. What is the most important consideration for the acquisition plan?

The laptop should be shut down immediately to preserve the SSD's state

The acquisition plan should focus on cloud backups instead of the local SSD

A logical acquisition is sufficient because SSDs do not retain deleted data

The SSD's TRIM may permanently erase deleted data, so the acquisition should occur as soon as possible

An examiner is building a timeline of system activity for a Windows 10 machine. They have collected the MFT, USN Journal, prefetch files, and the SYSTEM registry hive. Which combination of artifacts is most effective for correlating the execution of a specific program with the user who ran it?

Event logs and the BCD registry hive.

MFT and the SYSTEM hive's ControlSet001\Services.

Prefetch files and the UserAssist key in the NTUSER.DAT hive.

A forensic team is about to acquire a laptop that is currently running and has an encrypted hard drive (BitLocker). The suspect is logged on and the drive is unlocked. What is the most appropriate acquisition approach to preserve evidence?

Power off the laptop immediately and then image the drive using a write blocker

Remove the hard drive and image it using a hardware write blocker

Perform a live acquisition of the running system, then create a forensic image of the unlocked volume

Boot from a forensic USB and image the drive

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 1)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 1–5

1application · medium
An examiner is analyzing a Windows 10 system and finds a prefetch file for a program that was executed. What information can be derived from the prefetch file?
Select an answer first
2foundation · easy
Which file system artifact is most useful for determining when a specific file was first created on an NTFS volume?
Select an answer first
3expert · hard
A forensic team is planning the acquisition of a corporate laptop that may contain evidence of intellectual property theft. The laptop is currently in use by the suspect, and the company wants to minimize disruption. The laptop has a solid-state drive (SSD) with TRIM enabled. What is the most important consideration for the acquisition plan?
Select an answer first
4expert · hard
An examiner is building a timeline of system activity for a Windows 10 machine. They have collected the MFT, USN Journal, prefetch files, and the SYSTEM registry hive. Which combination of artifacts is most effective for correlating the execution of a specific program with the user who ran it?
Select an answer first
5application · medium
A forensic team is about to acquire a laptop that is currently running and has an encrypted hard drive (BitLocker). The suspect is logged on and the drive is unlocked. What is the most appropriate acquisition approach to preserve evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.