In digital forensics, what is the primary objective of system and device analysis?

To recover all data from a device regardless of relevance to the investigation

To identify, preserve, and interpret digital evidence from systems and devices to support legal or investigative conclusions

To remove malicious software and secure the network against future attacks

To repair or restore systems and devices to their original working condition after an incident

An examiner is investigating a Windows system and finds that the prefetch files have been deleted. The examiner needs to determine which programs were executed. Which combination of artifacts should the examiner use to recover execution evidence?

The SYSTEM hive and the BCD registry

ShimCache, AmCache.hve, and UserAssist

Shortcut files and the RecentDocs key

Which data source is commonly used to build a timeline of system activity?

File system timestamps (MAC times) from files and directories

The physical size of the hard drive

The number of installed applications

An examiner is acquiring data from a mobile device that is powered off. Which acquisition method should be used to preserve the most data?

Perform a chip-off acquisition by removing the memory chip and reading it directly.

Perform a logical acquisition by booting the device and using the backup feature.

Perform a cloud backup acquisition by using the device's cloud account.

Perform a physical acquisition by connecting the device to a forensic tool while it is powered off.

What is the primary difference between logical and physical extraction in mobile device forensics?

Logical extraction requires root access, while physical extraction does not

Logical extraction is used only for iOS devices, while physical extraction is used for Android

Logical extraction retrieves files and data visible to the operating system, while physical extraction captures the raw flash memory image

Logical extraction is always faster than physical extraction

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 8)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 36–40

36foundation · easy
In digital forensics, what is the primary objective of system and device analysis?
Select an answer first
37expert · hard
An examiner is investigating a Windows system and finds that the prefetch files have been deleted. The examiner needs to determine which programs were executed. Which combination of artifacts should the examiner use to recover execution evidence?
Select an answer first
38foundation · easy
Which data source is commonly used to build a timeline of system activity?
Select an answer first
39application · medium
An examiner is acquiring data from a mobile device that is powered off. Which acquisition method should be used to preserve the most data?
Select an answer first
40foundation · easy
What is the primary difference between logical and physical extraction in mobile device forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.