An examiner is investigating a Windows system used by a single employee. The employee communicated with a colleague via a web-based email service and also used a desktop email client. Which set of artifacts would provide the most comprehensive evidence of the email communications?

Browser cache and history for the webmail, plus the desktop client's mailbox files and sent items

The system's hibernation file and the pagefile

The user's NTUSER.DAT and the Windows Search database

The email server's logs and the user's browser history

Which of the following is an example of correlating user artifacts to establish user activity?

Verifying the hard drive's serial number

Matching a file's creation time with a browser download timestamp

An examiner is investigating a Windows system where a user is suspected of using a portable application (e.g., a USB-launched browser) to avoid leaving traces. The examiner has found the portable browser's folder on the USB drive, but the system's local drives show no trace of the browser installation. Which artifact on the system would still indicate that the portable browser was executed?

The user's NTUSER.DAT UserAssist key

The Windows Prefetch files and the $MFT entries for the USB drive's files

The Windows Event Log for application errors

An examiner is documenting evidence from a Windows system. The examiner has collected the $MFT, USN Journal, and browser history. Which practice is most important for ensuring the evidence is admissible in court?

Use the most expensive forensic tool available

Ensure all artifacts are exported to a single PDF report

Analyze the artifacts on the original system to avoid copying errors

Document the acquisition process, including hashes and chain of custody, for each artifact

GIAC Certified Forensic Examiner

Domain 6Objective 1

User Artifact Analysis GCFE Practice Questions (Page 3)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 11–15

11application · medium
An examiner is investigating a Windows system used by a single employee. The employee communicated with a colleague via a web-based email service and also used a desktop email client. Which set of artifacts would provide the most comprehensive evidence of the email communications?
Select an answer first
12foundation · easy
Which of the following is an example of correlating user artifacts to establish user activity?
Select an answer first
13foundation · easy
Which type of communication artifact is typically stored in a database file by instant messaging applications?
Select an answer first
14expert · hard
An examiner is investigating a Windows system where a user is suspected of using a portable application (e.g., a USB-launched browser) to avoid leaving traces. The examiner has found the portable browser's folder on the USB drive, but the system's local drives show no trace of the browser installation. Which artifact on the system would still indicate that the portable browser was executed?
Select an answer first
15expert · hard
An examiner is documenting evidence from a Windows system. The examiner has collected the $MFT, USN Journal, and browser history. Which practice is most important for ensuring the evidence is admissible in court?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

User Artifact Analysis GCFE Practice Questions (Page 3)

Questions 11–15

An examiner is investigating a Windows system used by a single employee. The employee communicated with a colleague via a web-based email service and also used a desktop email client. Which set of artifacts would provide the most comprehensive evidence of the email communications?

Which of the following is an example of correlating user artifacts to establish user activity?

Which type of communication artifact is typically stored in a database file by instant messaging applications?

An examiner is documenting evidence from a Windows system. The examiner has collected the $MFT, USN Journal, and browser history. Which practice is most important for ensuring the evidence is admissible in court?

Keep studying — User and Cloud Artifacts