An examiner is building a timeline of user activity and finds conflicting timestamps between the browser history and the NTFS $MFT. Which approach would be most appropriate to resolve the conflict?

Ignore the conflict and use only the earliest timestamp

Trust the browser history timestamps because they are user-specific

Correlate the timestamps with other artifacts such as the USN Journal and Windows Event Logs

Trust the $MFT timestamps because they are file system-level

During a forensic examination, you need to determine whether a user visited a specific internal HR portal during a two-hour window. The user's browser history has been cleared. Which approach would provide the most reliable evidence of the visit?

Analyze the $LogFile for changes to the browser's history database

Examine the browser's cache and DNS cache for the HR portal's hostname

Check the user's prefetch files for the browser executable

Review the Windows Event Log for network logon events

You are examining a Windows system where a user is suspected of accessing a confidential file that was later deleted. The file's $MFT entry has been overwritten. Which artifact would be most likely to contain remnants of the file's content?

Unallocated space on the volume

Which of the following is a critical step in preserving user artifacts for legal proceedings?

Installing forensic tools on the original system

Deleting unnecessary files to speed up analysis

Creating a forensic image of the original media

Booting the system to examine artifacts

GIAC Certified Forensic Examiner

Domain 6Objective 1

User Artifact Analysis GCFE Practice Questions (Page 7)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 31–35

31foundation · easy
Which folder within a Windows user profile typically contains the user's downloaded files?
Select an answer first
32expert · hard
An examiner is building a timeline of user activity and finds conflicting timestamps between the browser history and the NTFS $MFT. Which approach would be most appropriate to resolve the conflict?
Select an answer first
33application · medium
During a forensic examination, you need to determine whether a user visited a specific internal HR portal during a two-hour window. The user's browser history has been cleared. Which approach would provide the most reliable evidence of the visit?
Select an answer first
34application · medium
You are examining a Windows system where a user is suspected of accessing a confidential file that was later deleted. The file's $MFT entry has been overwritten. Which artifact would be most likely to contain remnants of the file's content?
Select an answer first
35foundation · easy
Which of the following is a critical step in preserving user artifacts for legal proceedings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.