An examiner is correlating events across multiple systems to determine the sequence of a data breach. The examiner has Windows event logs, prefetch files, and registry data from several machines. What is the most effective method to reconstruct the order of activities?

Analyze each system's event logs separately and compare manually

Use the registry's LastWrite times to determine the order of all events

Create a super timeline that combines all artifacts with normalized timestamps

Focus only on the most recent timestamps from each system

A forensic examiner receives an Android device that is powered off. The device has full-disk encryption and the user has provided the passcode. The examiner needs to acquire a physical image of the device. What is the most appropriate method?

Power on the device, enter the passcode to decrypt, and then use a commercial tool to perform a physical acquisition

Boot the device into fastboot mode and use fastboot to image the partitions

Use ADB backup to extract app data after booting

Remove the NAND chip and read it directly with a chip-off method

An examiner is reconstructing a timeline of a data exfiltration incident. The examiner has a Windows system with NTFS, prefetch files, and event logs. The system clock was changed during the incident. What is the most important consideration when building the timeline?

Correlate timestamps with known external events to identify clock skew and adjust for time changes

Use only the file system timestamps because they are the most reliable

Use the event log timestamps as the authoritative source

Ignore the clock change and rely on the order of events as recorded

An analyst is examining a Windows 10 system and finds that the UserAssist key in NTUSER.DAT has been cleared. However, the analyst needs to determine which programs were executed. Which alternative artifacts should the analyst use to recover execution evidence?

Prefetch files, ShimCache, and AmCache.hve

Shortcut files and the RecentDocs key

The SYSTEM hive and the BCD registry

Which Windows artifact is most useful for determining which files a user recently opened from a USB drive?

Windows shortcut (.lnk) files, which may contain the original file path and drive letter

The Windows registry key for display settings

The Windows event log for application crashes

The Windows Prefetch file for the USB drive

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 4)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 16–20

16application · medium
An examiner is correlating events across multiple systems to determine the sequence of a data breach. The examiner has Windows event logs, prefetch files, and registry data from several machines. What is the most effective method to reconstruct the order of activities?
Select an answer first
17expert · hard
A forensic examiner receives an Android device that is powered off. The device has full-disk encryption and the user has provided the passcode. The examiner needs to acquire a physical image of the device. What is the most appropriate method?
Select an answer first
18expert · hard
An examiner is reconstructing a timeline of a data exfiltration incident. The examiner has a Windows system with NTFS, prefetch files, and event logs. The system clock was changed during the incident. What is the most important consideration when building the timeline?
Select an answer first
19expert · hard
An analyst is examining a Windows 10 system and finds that the UserAssist key in NTUSER.DAT has been cleared. However, the analyst needs to determine which programs were executed. Which alternative artifacts should the analyst use to recover execution evidence?
Select an answer first
20foundation · easy
Which Windows artifact is most useful for determining which files a user recently opened from a USB drive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.