GCFA Windows Artifact Analysis — 15 Questions

Question 1

An analyst discovers a suspicious executable in a user's AppData folder. Which Windows artifact should be examined first to determine if the file was executed via a specific user action or a scheduled task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

UserAssist. UserAssist tracks GUI-based application execution, while Prefetch provides execution history regardless of the launch method. To differentiate between user-driven execution and background tasks, an analyst must correlate UserAssist entries with the Task Scheduler logs or Prefetch files. Understanding the launch vector is critical to determining if the activity was manual interaction or automated persistence, which guides the subsequent scope of the investigation into potential lateral movement or malicious automation.

Answer

ShimCache (AppCompatCache)

Answer

Amcache.hve

Answer

SRUM (System Resource Usage Monitor)

Question 2

Which TWO of the following artifacts are most effective for identifying file system activity that occurred immediately before a system shutdown or sudden crash?

Accepted Answer

ShellBags. Analyzing recent file activity requires artifacts that persist across volatile states. The Registry's ShellBags preserve folder view settings, and the RecentDocs key tracks items accessed through the Windows shell. By examining these, analysts can reconstruct the final user actions before a loss of power or system crash. This is vital for incidents involving anti-forensics or attempts to hide evidence by inducing a system failure to prevent proper log flushing.

Answer

Event Log 7040

Answer

SAM Hive

Answer

System Resource Usage Monitor (SRUM)

Question 3

Refer to the exhibit. Based on the USN Journal output, what can the analyst conclude about the file 'secret_data.docx'?

Accepted Answer

The file was created and modified by the user at 14:22:05.. The USN Journal logs low-level modifications to the NTFS volume. The presence of 'FileCreate' followed by 'DataOverwrite' and 'Close' indicates the file was generated and then modified within the same timeframe. This allows an analyst to build a precise sequence of events for a specific file. Understanding these flags is critical for proving data staging or exfiltration activities when other high-level application logs may have been wiped by the adversary.

Answer

The file was deleted immediately after being created.

Answer

The file was moved from a different volume.

Answer

The file is currently open by an active process.

Question 4

An analyst is investigating a compromised system and finds that the 'LastWrite' time of a specific registry key has been modified to match the surrounding keys. Which artifact should be checked to detect this timestomping attempt?

Accepted Answer

USN Journal. Registry keys do not maintain a comprehensive history of modification times, making them vulnerable to timestomping. However, the Transaction Logs (hive transaction files) and the USN Journal record low-level file system and registry transactions. By comparing the high-level registry timestamps with the low-level journal entries, an analyst can detect discrepancies. This is essential for uncovering sophisticated attackers who attempt to blend in by falsifying temporal evidence during a post-exploitation phase.

Answer

Prefetch files

Answer

Windows Event Logs

Answer

ShimCache

Question 5

Which THREE pieces of information can be extracted from a parsed Windows 'Jump List' artifact?

Accepted Answer

The full path of the accessed file. Jump Lists are essential for understanding user interaction with specific applications. They record recently accessed files, pinned items, and the application ID associated with those objects. By analyzing these, an analyst can determine if a user opened sensitive documents or used specific tools, providing a window into their recent workflow. This artifact is a primary target for evidence of data exfiltration, as it captures the file paths and access times of opened documents.

Answer

The user's password hash

Answer

The system's BIOS version

Question 6

An analyst is investigating an unauthorized remote connection. Which artifact, located in the SYSTEM hive, provides evidence of network interface configuration changes that might indicate an attacker-controlled VPN or bridge?

Accepted Answer

NetworkList Key. The Windows registry maintains a detailed history of network configuration in the 'NetworkList' key. Changes here can signify the introduction of new network adapters or VPN configurations that could facilitate unauthorized remote access. Detecting these changes is crucial for understanding how an attacker maintained persistence or bypassed network security controls, as it provides a clear temporal record of when the network environment was modified to support their malicious activity.

Answer

Software Hive (Services)

Answer

SAM Hive

Answer

Amcache.hve

Question 7

Refer to the exhibit. An attacker modified the SpecialPollInterval value. What is the primary forensic implication of this change on a compromised system?

Accepted Answer

The system clock accuracy is compromised for log correlation.. Modifying the NTP poll interval is a common technique used by attackers to de-synchronize the system clock or force frequent synchronization, which can interfere with the accuracy of log timestamps. Forensic integrity relies on accurate timekeeping for timeline analysis. If an attacker tampers with time synchronization, they can effectively hide their activity by shifting the perceived time of events, potentially invalidating evidence or causing correlation failures across logs.

Answer

The system will automatically reboot every hour.

Answer

The registry key change triggers a System Audit log.

Answer

The system will be unable to connect to the domain.

Question 8

Which THREE artifacts are essential for identifying the presence and execution of 'Living off the Land' (LotL) binaries like PowerShell or WMI on a Windows host?

Accepted Answer

Prefetch files. LotL attacks utilize trusted system tools to perform malicious actions, making them difficult to detect. Prefetch files capture command-line arguments for executed processes, while the Security Event Logs (specifically 4688) provide detailed process creation events. Finally, the Amcache.hve can provide metadata about the versions of these binaries. Together, these sources allow an analyst to prove that a legitimate tool was used in an illegitimate way, which is central to most modern incident response cases.

Answer

SAM Hive

Answer

Software Hive

Question 9

Refer to the exhibit. What is the significance of the 'LastWrite' time for this specific registry key?

Accepted Answer

It represents the first time the device was connected.. The LastWrite time on an Enum key in the SYSTEM hive indicates when the device was first installed or when its configuration was last updated. This provides a temporal anchor for the device's introduction to the system. Understanding this is critical for scoping the window of opportunity during which data could have been exfiltrated, especially when combined with other artifacts that show user file system activity after this connection timestamp.

Answer

It shows when the file 'Cruzer_Glide' was last run.

Answer

It indicates the time the device was safely removed.

Answer

It confirms that the user deleted the device driver.

Question 10

When reviewing 'ShimCache' (AppCompatCache), what does an entry with an empty 'Last Modified' time suggest to an investigator?

Accepted Answer

The file was executed but not properly cached.. ShimCache is a memory-resident structure that is written to the SYSTEM hive upon system shutdown. An entry with an empty or null 'Last Modified' time often indicates that the file was executed, but the system did not complete a clean shutdown, or the entry was part of a memory-only process that never successfully committed its metadata to the hive. This is a critical indicator of potential system instability or a forced power-off event.

Answer

The file was executed from a network share.

Answer

The file is a system binary protected by Windows.

Answer

The file was recently deleted from the system.

Question 11

Which Windows artifact should an analyst investigate to identify the specific time a user last modified a local folder's view settings?

Accepted Answer

ShellBags. ShellBags are stored in the USRCLASS.DAT hive and are specifically designed to preserve the folder view settings, such as icon size and window position. Because these settings are updated every time a user navigates into a folder, ShellBags provide a continuous record of directory access. This is essential for reconstructing user activity patterns and proving that a user navigated into specific folders that they claimed never to have accessed.

Answer

NTUSER.DAT RecentDocs

Answer

Prefetch files

Answer

Amcache.hve

Question 12

Which TWO of the following artifacts are most reliable for determining user-initiated file execution on a Windows 10 system?

Accepted Answer

UserAssist. UserAssist and Prefetch are the most reliable indicators of user-initiated execution. UserAssist tracks GUI-launched programs, providing a count and last execution time, while Prefetch creates files specifically to speed up application startup. These artifacts together offer a comprehensive view of execution history, allowing investigators to distinguish between system-level background processes and files directly launched by a user during a suspected security incident or system compromise.

Answer

Shimcache

Answer

Amcache

Answer

Registry 'Run' Keys

Question 13

Which THREE of the following items are commonly found within the Windows Prefetch file structure?

Accepted Answer

Execution counter. Prefetch files are designed to optimize application launch. They store the file path, execution count, last run times, and a list of files or directories loaded by the executable during the first ten seconds of execution. This data is invaluable for digital forensics as it confirms program execution, identifies dependencies used by the malware, and provides a timeline of activity for specific applications discovered during the investigation.

Answer

User security identifier (SID)

Answer

Registry key path modification

Question 14

What is the primary forensic value of the Amcache.hve hive when investigating software installation on Windows 10?

Accepted Answer

It provides the SHA1 hash of the executed file.. Amcache.hve is a registry hive that stores information about executed applications, including file paths, SHA1 hashes, and compilation timestamps. It is highly effective for identifying software that has been removed from the system, as the entries often persist even after the corresponding binary is deleted. This makes it an essential tool for recovering evidence of malicious tools that an attacker may have attempted to clean up after their activity.

Answer

It stores user credentials used during application launch.

Answer

It tracks the exact network connections made by an application.

Answer

It records the full command-line arguments used for execution.

Question 15

Which THREE of the following items can typically be extracted from a LNK file during a forensic investigation?

Accepted Answer

Volume Serial Number of the target drive. LNK files are shortcuts that contain metadata about the target file they point to. They include the original file path, volume serial number, MAC addresses, and modification timestamps of the target object. This information is crucial for proving that a user had access to specific files, even if those files were on external media, and helps correlate user actions with the presence of suspicious data on the system.

Answer

The user's password hash

Answer

Full contents of the target file