User Artifact Analysis GCFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are investigating a Windows system where the user is suspected of downloading an illegal image from a website. The browser's download history has been cleared. Which artifacts would be most useful to prove the download occurred?

   • AThe browser's cache and the $MFT entries for the downloaded file
   • BThe system's DNS cache and the Windows Event Log for file creation
   • CThe user's NTUSER.DAT and the Windows Prefetch files
   • DThe Recycle Bin and the user's Recent Items
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forensic examiner needs to identify all user-specific artifacts on a Windows 10 system for a single user account. Which approach would most comprehensively identify the user's artifacts?

   • AExamine the Windows Event Logs for user logon events
   • BExamine only the C:\Users\Public folder and the system-wide registry hives
   • CExamine the $MFT and $LogFile for all files on the system
   • DExamine the user's profile folder, NTUSER.DAT, and associated registry hives
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An examiner needs to document the acquisition of a user's NTUSER.DAT hive for legal proceedings. Which documentation practice is most important to ensure the evidence is admissible?

   • ATake a screenshot of the registry hive in Regedit
   • BRecord the cryptographic hash of the original and the copy, and document the acquisition process
   • CStore the original hive on the examiner's workstation
   • DUse a write-blocker and document the tool version
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An examiner is analyzing a Windows 10 system with multiple user profiles. The suspect user's profile appears to have been recently deleted, but the examiner needs to determine if the user had accessed a specific file. Which approach would be most effective?

   • AExamine the Windows Event Logs for user logon events
   • BExamine the $MFT for remnants of the user's profile files and the USN Journal for deletion records
   • CExamine the Recycle Bin for deleted profile files
   • DExamine the SYSTEM registry hive for user profile list keys
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An examiner is investigating a case involving Skype communications. The user has uninstalled Skype from their Windows 10 system. Which artifact would be most likely to contain remnants of the Skype chat history?

   • AThe Skype local database files in the user's AppData folder, even if uninstalled
   • BThe user's browser history for Skype web access
   • CThe user's NTUSER.DAT registry hive
   • DThe Windows Event Logs for Skype application events
   Reveal Solution Discussion Select an answer first