What is the recommended first step when acquiring evidence from a powered-on Windows computer?

Immediately pull the power plug to preserve the hard drive

Create a forensic image of the hard drive before touching the system

Reboot the system into a forensic boot environment

Document the system state and capture volatile data such as running processes and network connections

What is file carving in digital forensics?

The process of recovering files from unallocated space based on file signatures without relying on file system metadata

The process of deleting files permanently from a storage device

The process of compressing files to save storage space during an investigation

The process of encrypting files to protect them from tampering

An examiner is analyzing a Windows 10 system and finds a .lnk file in the user's Recent Items folder that points to a document on a network share. What can this artifact indicate about user activity?

The user accessed the document from the network share at some point.

The document was deleted from the network share.

The user downloaded the document to the local machine.

The user has administrative privileges on the network share.

Which element should be included in a forensic report to allow another examiner to reproduce the analysis?

The estimated cost of the investigation

A detailed description of the tools, versions, and procedures used

The personal opinions of the examiner about the suspect's guilt

The names of all employees at the forensic lab

During a forensic examination of an NTFS volume, the analyst finds that a file's MFT entry indicates the file is active, but the file's data runs point to clusters that are marked as unallocated. What does this indicate, and what should the analyst do?

The file is encrypted by EFS and the analyst needs the decryption key

The file is a hard link and the data is stored elsewhere

The file is a sparse file and the data is not actually stored on disk

The file is likely a victim of a file system inconsistency; the analyst should note it and attempt to recover data from the unallocated clusters

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 2)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 6–10

6foundation · easy
What is the recommended first step when acquiring evidence from a powered-on Windows computer?
Select an answer first
7foundation · easy
What is file carving in digital forensics?
Select an answer first
8application · medium
An examiner is analyzing a Windows 10 system and finds a .lnk file in the user's Recent Items folder that points to a document on a network share. What can this artifact indicate about user activity?
Select an answer first
9foundation · easy
Which element should be included in a forensic report to allow another examiner to reproduce the analysis?
Select an answer first
10application · medium
During a forensic examination of an NTFS volume, the analyst finds that a file's MFT entry indicates the file is active, but the file's data runs point to clusters that are marked as unallocated. What does this indicate, and what should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.