An examiner is analyzing a Windows 10 system where a user is suspected of accessing a file on a network share. The user's local profile shows no direct evidence of the file being opened. Which registry artifact could provide evidence of the network file access?

The UserAssist key and the Recent Items folder's LNK files

An examiner is investigating a Windows system where the user communicated via a web-based chat service. The user's browser history has been cleared, and the system was rebooted after the chat session. Which artifact is most likely to contain remnants of the chat messages?

The system's hibernation file or pagefile

The Windows Event Log for network connections

An examiner needs to determine whether a user deleted a specific file from a Windows 10 system. The file was stored on an NTFS volume. Which file system artifact would most reliably indicate the deletion of the file and its original location?

The Recycle Bin folder on the system

The NTFS $LogFile, which records transactional changes

The NTFS USN Journal, if enabled

The NTFS $MFT entry for the file, if it still exists

During a forensic examination, you need to determine which websites a user visited on a specific date. The user primarily used Google Chrome. Which artifact would provide the most direct evidence of the user's web browsing activity for that date?

The Chrome 'Cookies' SQLite database in the user's profile

The user's 'Downloads' folder and file metadata

The Chrome 'History' SQLite database located in the user's profile

The Chrome 'Cache' folder in the user's profile

Which of the following is a common location for Microsoft Outlook email data on a Windows system?

C:\Program Files\Microsoft Office

C:\Users\ \AppData\Local\Microsoft\Outlook

GIAC Certified Forensic Examiner

Domain 6Objective 1

User Artifact Analysis GCFE Practice Questions (Page 2)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 6–10

6expert · hard
An examiner is analyzing a Windows 10 system where a user is suspected of accessing a file on a network share. The user's local profile shows no direct evidence of the file being opened. Which registry artifact could provide evidence of the network file access?
Select an answer first
7expert · hard
An examiner is investigating a Windows system where the user communicated via a web-based chat service. The user's browser history has been cleared, and the system was rebooted after the chat session. Which artifact is most likely to contain remnants of the chat messages?
Select an answer first
8application · medium
An examiner needs to determine whether a user deleted a specific file from a Windows 10 system. The file was stored on an NTFS volume. Which file system artifact would most reliably indicate the deletion of the file and its original location?
Select an answer first
9application · medium
During a forensic examination, you need to determine which websites a user visited on a specific date. The user primarily used Google Chrome. Which artifact would provide the most direct evidence of the user's web browsing activity for that date?
Select an answer first
10foundation · easy
Which of the following is a common location for Microsoft Outlook email data on a Windows system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.