GCFA Practice Test 15 — 15 Questions

Question 1

An investigator is analyzing an NTFS volume and finds that a file's $DATA attribute is non-resident and its data runs point to clusters that are currently allocated to a different file. The file's size is 10 KB. What is the most likely explanation for this situation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file's data runs are corrupt or the MFT entry is inconsistent, possibly due to disk corruption or deliberate manipulation.. A non-resident $DATA attribute with data runs pointing to clusters allocated to another file is an abnormal condition. Standard NTFS features like compression, sparse files, or encryption do not cause such overlap. This inconsistency suggests corruption or intentional manipulation, requiring further forensic examination to determine the cause and potential data recovery challenges.

Answer

The file is encrypted, and the data runs are stored in the $EFS attribute instead of $DATA.

Answer

The file is sparse, and the data runs include sparse ranges that map to clusters not physically allocated.

Answer

The file is compressed, and the data runs are stored in a separate $DATA attribute named $TXF_DATA.

Question 2

An investigator is analyzing an NTFS volume and finds that a file's $DATA attribute is non-resident and its data runs point to clusters that are currently allocated to a different file. The file's size is 10 KB. What is the most likely explanation for this situation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was deleted and later a new file with the same name was created, leaving a stale MFT record alongside the active one.. NTFS does not immediately clear MFT records when files are deleted; the record is marked unallocated but its contents may persist until reused. A subsequent file with the same name is assigned a new record number, producing two records with the same $FILE_NAME. The active record typically contains the live $DATA and an $OBJECT_ID, while the stale record may show remnants such as zero-length data.

Answer

A hard link was created, so the original MFT record was repurposed while a new record was allocated for the additional filename reference.

Answer

The volume is part of a Distributed File System replica, and DFSR metadata duplicated the MFT record during replication.

Answer

The file was compressed, causing NTFS to create a shadow MFT record for the compressed data stream.

Question 3

A forensic analyst is reviewing an NTFS volume from a Windows 10 workstation. The analyst finds an MFT entry whose $STANDARD_INFORMATION attribute contains four timestamps that are all set to a date three years in the past, but the corresponding $FILE_NAME attribute timestamps show dates within the past week. The file's content matches a recently created document. Which conclusion is most strongly supported by this artifact discrepancy?

Accepted Answer

The $STANDARD_INFORMATION timestamps were deliberately altered by a timestomping tool, while the $FILE_NAME timestamps reflect the actual file system activity.. The $STANDARD_INFORMATION attribute is the primary target of timestomping tools because it is what most user-facing interfaces display. The $FILE_NAME attribute, which is indexed in the directory entry, is often left unchanged by such tools. A large discrepancy where $STANDARD_INFORMATION is backdated but $FILE_NAME reflects recent activity is a classic indicator of deliberate timestamp manipulation.

Answer

The file was copied from an external NTFS volume, which preserved the original $STANDARD_INFORMATION timestamps but updated the $FILE_NAME timestamps.

Answer

The volume was formatted with a non-default cluster size, which causes $STANDARD_INFORMATION and $FILE_NAME timestamps to be updated independently.

Answer

The file system journal was replayed after an unclean shutdown, causing the $STANDARD_INFORMATION timestamps to roll back while the $FILE_NAME timestamps were left intact.

Question 4

An analyst is reviewing a Windows 10 endpoint and finds that a scheduled task was created to run a PowerShell script at logon. The task was likely created by an attacker to maintain persistence. Which artifact should the analyst examine to determine the exact time the task was registered and the user account that created it?

Accepted Answer

The Security event log, filtering for event ID 4698. Security event ID 4698 is the definitive artifact for scheduled task creation because it captures the task name, the creating user, and the timestamp. Other artifacts like the Task Scheduler operational log or registry keys may show the task exists or when it ran, but they do not reliably provide both the creator identity and the exact creation time, which are critical for attribution in an intrusion investigation.

Answer

The Task Scheduler operational event log (Microsoft-Windows-TaskScheduler/Operational.evtx)

Answer

The registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

Answer

The Task Scheduler operational log, filtering for event ID 106

Question 5

An investigator is examining an NTFS volume from a system that was abruptly powered off during a malware installation. The analyst observes that the MFT contains a file record for a suspicious executable with a valid $DATA attribute, but the file is not visible in the directory index. Which NTFS artifact should the analyst examine to determine whether the file record was orphaned due to an interrupted transaction?

Accepted Answer

The $LogFile, which contains redo and undo records that can show incomplete metadata transactions from the power loss.. $LogFile is the NTFS write-ahead journal that ensures metadata consistency. It records redo and undo information for transactions. After an abrupt power loss, incomplete transactions may leave the MFT updated but the directory index not, producing an orphaned file record. Analyzing $LogFile can reveal the interrupted operation and help reconstruct the intended state.

Answer

The $Secure:$SDS stream, which stores security descriptors and would show if the file's permissions were applied during creation.

Answer

The $UsnJrnl:$J, which records all file system changes and would show the file creation event even if the directory index was not updated.

Answer

The $Bitmap, which tracks cluster allocation and would indicate whether the file's clusters were allocated before the power loss.

Question 6

An analyst is investigating a Windows 10 system and discovers that a user's NTUSER.DAT registry hive contains a key named 'RecentDocs' with numerous entries. What is the primary forensic significance of this artifact?

Accepted Answer

It maintains a list of recently accessed files and folders, which can indicate user browsing activity and potential data exfiltration.. RecentDocs provides a list of recently accessed files and folders, which is valuable for understanding user activity and potential data exfiltration. It does not include hashes, execution times, or last access timestamps, so the correct interpretation is that it indicates browsing activity and accessed documents.

Answer

It stores the complete file path and SHA-256 hash of every document opened by the user.

Answer

It records the most recently opened documents and folders, including the last access time and the application used to open them.

Answer

It tracks the execution time of applications associated with the opened documents.

Question 7

An analyst is examining a Windows 10 workstation that is suspected of having a malicious service installed for persistence. The analyst wants to determine the original path of the service executable and the account it runs under. Which registry location should the analyst examine to find this information?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. The Services registry key stores configuration data for every Windows service, including the ImagePath value that points to the executable and the ObjectName value that specifies the account. Examining this key allows the analyst to identify the malicious service's original path and the security context it uses, which is critical for understanding persistence and privilege level.

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager

Question 8

An analyst is investigating a Windows 10 system and finds a suspicious shortcut file in a user's Recent folder. The analyst wants to determine the full path of the target file and any command-line arguments used when the shortcut was created. Which artifact should the analyst examine?

Accepted Answer

The .lnk file itself. Shortcut (.lnk) files contain embedded structures that include the target path, working directory, command-line arguments, and other metadata. Parsing these files directly provides the most accurate and detailed information about the shortcut's target, which is essential for understanding what the shortcut would execute.

Answer

The Windows Registry key: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Answer

The Prefetch file for explorer.exe

Answer

The jumplist AutomaticDestinations file

Question 9

A forensic analyst is examining an NTFS volume and needs to determine whether a specific file was recently deleted and whether its data clusters have been reallocated. The analyst has access to the MFT, the $Bitmap metadata file, and the $UsnJrnl. Which two artifacts should the analyst correlate to confirm that the file's MFT record is unallocated and that its clusters are now marked as free? (Choose two.)

Accepted Answer

The in-use flag in the file's MFT record header, which indicates whether the record is allocated or unallocated.. To confirm that a file's MFT record is unallocated and its clusters are free, the analyst should check the in-use flag in the MFT record header and the corresponding bits in the $Bitmap file. The in-use flag directly indicates whether the record is allocated, while the $Bitmap tracks cluster allocation across the volume. Together they provide definitive evidence of deletion and cluster reallocation status.

Answer

The $Secure metadata file, which contains security descriptors and can indicate whether the file was protected from deletion.

Answer

The $LogFile, which records all metadata transactions and can show the exact deletion operation.

Answer

The $UsnJrnl, which records file system changes including deletions and can provide a timestamp for the deletion event.

Question 10

An investigator is analyzing a Windows 10 system where an attacker allegedly used a PowerShell script to download and execute a malicious payload. The investigator wants to determine the exact PowerShell commands that were executed. Which Windows artifact should the investigator examine to find this information?

Accepted Answer

PowerShell Operational Event Log. PowerShell Operational logging, when script block logging is enabled, captures the full content of scripts and commands executed, including those run by attackers. This makes it the most reliable artifact for reconstructing the exact PowerShell activity. Other artifacts like Prefetch or Security logs may show that PowerShell ran but not what it executed.

Answer

Windows Security Event Log

Answer

ConsoleHost_history.txt file

Answer

Prefetch files for PowerShell.exe

Question 11

An analyst is examining a Windows 10 system to determine if a specific USB device was connected. The analyst has already checked the registry and found no trace in USBSTOR. Which TWO additional artifacts should the analyst examine to corroborate USB device connection? (Choose two.)

Accepted Answer

Setupapi.dev.log. Setupapi.dev.log and the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log both record USB device installation and connection events with timestamps and device identifiers. These artifacts can provide evidence of a USB device even if the USBSTOR registry key has been cleared, making them essential for corroboration.

Answer

Prefetch files for USBSTOR.SYS

Answer

Registry key: HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

NTFS $MFT

Question 12

A forensic analyst is reviewing an NTFS volume and notices that a particular file has an $ATTRIBUTE_LIST attribute in its MFT record. What does the presence of this attribute indicate about the file?

Accepted Answer

The file's attributes are spread across multiple MFT records because they do not fit in a single record.. The $ATTRIBUTE_LIST attribute is present when a file's attributes cannot fit in a single MFT record. It enumerates the attributes and their locations, which may be in additional MFT records. This is common for files with many attributes or large attributes like long $DATA runs or numerous alternate data streams. Its presence indicates that the file's metadata is distributed across multiple MFT records.

Answer

The file has multiple $DATA attributes, indicating alternate data streams.

Answer

The file is compressed, and the $ATTRIBUTE_LIST contains the compression unit size.

Answer

The file is encrypted with EFS, and the $ATTRIBUTE_LIST stores encryption keys.

Question 13

An analyst is examining an NTFS volume and finds that a file's $DATA attribute is non-resident, but the file size reported by the operating system is 0 bytes. The analyst suspects the file may have been involved in a data hiding technique. Which of the following is the most likely explanation for this discrepancy?

Accepted Answer

The file's $DATA attribute has a logical size of 0 but still has allocated clusters, indicating possible slack space or hidden data.. A non-resident $DATA attribute with a logical size of 0 but allocated clusters is a classic sign of data hiding. An attacker can write data to a file, then truncate the file's logical size to 0 without deallocating the clusters, leaving the data intact in the allocated clusters. Forensic tools can parse the data runs and recover the hidden content. This technique is often used to conceal data on NTFS volumes.

Answer

The file is a sparse file, and the 0-byte size indicates that all its data is stored in sparse regions.

Answer

The file's data runs point to clusters that have been marked as bad and are no longer accessible.

Answer

The $DATA attribute is corrupted, and the file system is reporting an incorrect size.

Question 14

An analyst is examining an NTFS volume and finds a file named 'confidential.docx' in a directory. The file's MFT record shows that the $DATA attribute is resident. What does this indicate about the file's data storage, and what is the primary forensic implication?

Accepted Answer

The file's content is stored entirely within the MFT record, and the analyst can recover it directly from the MFT without carving the disk.. A resident $DATA attribute indicates that the file's content is small enough to be stored directly within the MFT record. This means the analyst can recover the file content by parsing the MFT entry, without needing to locate clusters on disk. It is a simpler recovery scenario than non-resident data, which requires following data runs to clusters.

Answer

The file's content is encrypted with EFS, and the resident $DATA attribute stores the encryption keys.

Answer

The file's content is stored in clusters outside the MFT, and the analyst must use the data runs to locate it on disk.

Answer

The file's content is compressed and stored in the MFT record, requiring decompression before analysis.

Question 15

An analyst is examining a Windows 10 system to determine if a specific user account was used to access files on a remote share. Which two artifacts would provide the most direct evidence of this activity? (Choose two.)

Accepted Answer

Security Event ID 4624 with Logon Type 3. Security Event ID 4624 with Logon Type 3 and Event ID 5140 both directly record network logons and share access, respectively. They provide the account, timestamp, and share details needed to prove a user accessed a remote share. The other artifacts lack the specificity to directly evidence this activity.

Answer

UserAssist registry keys

Answer

Prefetch files for the remote access client

Answer

Sysmon Event ID 3 (Network Connection)