An examiner is investigating a Windows system used by an employee who communicated with an external party using a chat application. The chat application stores its data in a local database. Which artifact would be most useful to recover deleted chat messages?

The user's NTUSER.DAT and the Windows Prefetch files

The Windows Event Log for application errors

Unallocated space and the application's database journal files

The browser's cache and history

Which local artifact is commonly associated with Google Drive's sync client on Windows?

A database in the Windows Event Log

A file named 'cloud.txt' in System32

A folder named 'Google Drive' in the user profile

A registry key under HKLM\Software\Google\Drive

What is the primary purpose of correlating user artifacts from multiple sources in a forensic investigation?

To determine the operating system version

To reduce the amount of data that needs to be analyzed

To identify the owner of the computer

To build a comprehensive timeline of user actions

An examiner is building a timeline of a user's activities on a Windows 10 system. Which combination of artifacts would provide the most comprehensive timeline?

Windows Event Logs and the SYSTEM registry hive

Browser history, NTUSER.DAT RecentDocs, and $MFT timestamps

The USN Journal and the user's browser cache

The user's profile folder and the Recycle Bin

An examiner needs to recover chat messages from a user's Windows 10 system. The user used the Microsoft Teams desktop application. Which artifact would be most likely to contain the chat history?

The user's browser history for Teams web access

The user's NTUSER.DAT registry hive

The Windows Event Logs for Teams application events

The Teams local database files in the user's AppData folder

GIAC Certified Forensic Examiner

Domain 6Objective 1

User Artifact Analysis GCFE Practice Questions (Page 8)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 36–40

36application · medium
An examiner is investigating a Windows system used by an employee who communicated with an external party using a chat application. The chat application stores its data in a local database. Which artifact would be most useful to recover deleted chat messages?
Select an answer first
37foundation · easy
Which local artifact is commonly associated with Google Drive's sync client on Windows?
Select an answer first
38foundation · easy
What is the primary purpose of correlating user artifacts from multiple sources in a forensic investigation?
Select an answer first
39application · medium
An examiner is building a timeline of a user's activities on a Windows 10 system. Which combination of artifacts would provide the most comprehensive timeline?
Select an answer first
40application · medium
An examiner needs to recover chat messages from a user's Windows 10 system. The user used the Microsoft Teams desktop application. Which artifact would be most likely to contain the chat history?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.