GCFA Windows Artifact Analysis Practice Test 3 — 15 Questions

Question 1

An analyst is investigating a Windows 10 system for evidence of data exfiltration. The analyst discovers that a user recently accessed several files on a sensitive network share. Which artifact should the analyst examine to determine the specific files and folders that were accessed, and the timestamps of those accesses?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shell bags in the user's NTUSER.DAT and UsrClass.dat hives. Shell bags in the user's registry hives record folder view settings for local and network folders, including timestamps that indicate when the user first and last accessed those folders. This makes them valuable for determining which network share folders were browsed and when, aiding in data exfiltration investigations.

Answer

Link files (*.lnk) in the user's Recent folder

Answer

Jump Lists in the AutomaticDestinations folder

Answer

SRUM database, querying the Network Usage table for SMB traffic

Question 2

An analyst is investigating a Windows 10 system for evidence of data exfiltration. The analyst discovers that a user recently accessed several files on a sensitive network share. Which artifact should the analyst examine to determine the specific files and folders that were accessed, and the timestamps of those accesses?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The USBSTOR registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. The setupapi.dev.log and the USBSTOR registry key both record the volume serial number and drive letter for USB mass storage devices. Setupapi.dev.log captures installation details, while USBSTOR stores device-specific parameters including the volume serial and drive letter. The Partition/Diagnostic log lacks drive letter mapping, the USB drive's $MFT is not host-assigned, and Amcache.hve pertains to application execution.

Answer

The Amcache.hve registry hive

Answer

The Microsoft-Windows-Partition/Diagnostic event log

Answer

The $MFT record for the root directory of the USB drive

Question 3

An analyst is investigating a Windows 10 system for evidence of data exfiltration. The analyst discovers that a user recently accessed several files on a sensitive network share. Which artifact should the analyst examine to determine the specific files and folders that were accessed, and the timestamps of those accesses?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The Enum\USBSTOR registry key is the authoritative source for USB mass storage device forensics. It records each device's unique instance ID, volume serial number, and timestamps such as the last connected time. Other keys either cover all USB devices, focus on portable devices, or lack the specific metadata needed. Therefore, Enum\USBSTOR is the correct choice.

Answer

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Enum

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices

Question 4

When analyzing the 'TypedPaths' registry key, what type of user activity is being reviewed?

Accepted Answer

Windows Explorer navigation paths. The 'TypedPaths' key is a goldmine for investigators as it stores the absolute paths that a user has manually entered into the Windows Explorer address bar. This artifact is highly reliable for proving user intent to access specific directories, including hidden folders or external media paths. By documenting where the user navigated, an analyst can build a compelling case regarding unauthorized file exploration that occurred outside of normal GUI clicking behavior.

Answer

Run dialog commands

Answer

Recently opened documents

Answer

External device connection history

Question 5

An analyst discovers a file on a system that appears to be a 'hidden' executable. Which attribute of the NTFS file system, if modified, is a common indicator of a user attempting to conceal a file from standard Explorer views?

Accepted Answer

File Attribute Flags (MFT). NTFS file attributes allow users to hide files from the standard Windows Explorer interface. By checking the File Attributes field in the Master File Table (MFT), an analyst can identify files marked with the 'Hidden' or 'System' attribute. This is a common, albeit simple, anti-forensics technique used by adversaries to prevent casual discovery of malicious binaries or staged data, and it is the first step in identifying deliberate concealment attempts.

Answer

File Creation Timestamp

Answer

Extended Attributes (EA)

Answer

Access Control List (ACL)

Question 6

Which artifact is the most reliable for determining if an external USB mass storage device was mounted on a system, even if the device is no longer present?

Accepted Answer

USBSTOR Registry Key. The 'USBSTOR' registry key in the SYSTEM hive is the definitive artifact for tracking USB device history. It records the vendor, model, and unique serial number of every USB device ever connected. This is critical for forensic investigations involving data exfiltration, as it allows the investigator to prove that a specific physical device was present, regardless of whether the user deleted the device drivers or emptied the recycle bin.

Answer

Prefetch files

Answer

ShellBags

Answer

SRUM (System Resource Usage Monitor)

Question 7

Which registry hive contains the 'UserAssist' key, and what is its primary forensic value?

Accepted Answer

NTUSER.DAT hive; tracking user-initiated program execution. UserAssist is stored within the NTUSER.DAT hive of the specific user account. Its value lies in the rotational cipher (ROT13) used for the data, which, once decrypted, reveals a list of GUI-based programs executed by the user. This artifact is invaluable for linking specific user activity to the execution of malicious tools, providing proof that the user was behind the keyboard during the incident, as opposed to an automated system service.

Answer

SYSTEM hive; tracking system services

Answer

SOFTWARE hive; tracking installed application paths

Answer

SECURITY hive; tracking authentication logs

Question 8

An analyst discovers a suspicious executable in the C:\Users\Public folder. To determine if the file was executed, the analyst examines the Shimcache. Which behavior is characteristic of the Shimcache artifact?

Accepted Answer

It tracks file path and last modification time for potential application compatibility.. The Shimcache, or AppCompatCache, tracks file metadata to ensure application compatibility. Crucially, it tracks file paths and last modified times but does not natively record the exact execution timestamp of an application. It is primarily used to identify files that were present on the system and potentially executed, serving as a critical indicator of software presence during an investigation into lateral movement or malware persistence on a Windows endpoint.

Answer

It records the exact UTC execution time for all files in the SYSTEM hive.

Answer

Entries are only populated when the UserAssist key is enabled in the registry.

Answer

It is stored within the NTUSER.DAT hive for each individual user profile.

Question 9

An investigator is analyzing the Windows Event Logs and finds Event ID 4697. What is the primary significance of this event in the context of forensic analysis?

Accepted Answer

It signals the installation of a new service on the system.. Event ID 4697 indicates that a new service was installed on the system. This is a common technique for attackers to establish persistence. By monitoring this event, analysts can identify when malicious binaries were registered as services to run automatically upon system boot. This is critical for uncovering hidden persistence mechanisms and identifying the service name, binary path, and account used to execute the potentially malicious code.

Answer

It records the deletion of a user account from the local database.

Answer

It logs that a system service was started by the Service Control Manager.

Answer

It documents a failed attempt to modify an existing service.

Question 10

When reviewing Jump Lists on a Windows system, which file extension is commonly associated with the 'AutomaticDestinations' folder?

Accepted Answer

.automaticDestinations-ms. Jump Lists, located in the AutomaticDestinations and CustomDestinations folders, track recently accessed files and applications. The files are identified by an AppID, which is a hash of the application's path. These files often end with the .automaticDestinations-ms extension. They are vital for identifying files opened by users, providing insight into document access, media playback, and tool usage that may relate to intellectual property theft or evidence of work.

Answer

.pf

Answer

.log

Answer

.lnk

Question 11

What is the primary function of the ShellBags artifact in a Windows forensic investigation?

Accepted Answer

To demonstrate that a user navigated to a specific folder.. ShellBags are registry entries that store folder view preferences, such as window size, icon position, and folder sorting. For forensics, they are incredibly useful for proving that a user navigated to a specific directory in Windows Explorer. This is critical for demonstrating user intent, as it shows which folders were browsed, even if those folders were later deleted or were located on removable media that is no longer connected.

Answer

To track the history of web browser searches.

Answer

To log file deletion events in the Recycle Bin.

Answer

To record the last time a system was rebooted.

Question 12

When analyzing the Windows Registry, what is the primary purpose of the 'SAM' hive?

Accepted Answer

It contains local user account data and password hashes.. The SAM (Security Accounts Manager) hive contains local user account information, including password hashes and group memberships. It is a critical target during forensic analysis for identifying user accounts, password history, and potential privilege escalation attempts. By extracting these hashes, analysts can perform offline cracking to reveal passwords, which is often necessary to understand the full extent of a compromised account's capability within the organization's network.

Answer

It stores the system's network configuration and IP addresses.

Answer

It tracks all executed application history.

Answer

It holds the logs for all system boot events.

Question 13

Which of the following describes the correct function of the $MFT (Master File Table) in an NTFS-formatted Windows volume?

Accepted Answer

It holds the metadata for all files on the volume.. The MFT is the central database of an NTFS volume. It stores metadata for every file and directory on the disk, including file names, sizes, timestamps, and data runs. For forensic analysts, the MFT is the most important artifact, as it provides a comprehensive map of all files, including deleted ones, allowing for the reconstruction of the file system and identification of malicious files that were intentionally erased by an adversary.

Answer

It is an application log that tracks system crashes.

Answer

It stores user credentials for encrypted files.

Answer

It is only used to store files larger than 1GB.

Question 14

During an intrusion investigation, an analyst needs to determine the exact moment a malicious service was installed on a Windows 10 host. The attacker deleted the service's executable and cleared the System event log. Which artifact should the analyst examine to recover the service installation timestamp?

Accepted Answer

Registry key LastWrite time under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>. The Services registry key maintains configuration data for each service, and its LastWrite time updates upon creation or modification. This artifact survives executable deletion and log clearing, offering a reliable timestamp for service installation. Other artifacts like SRUM, Prefetch, or Amcache provide execution or resource usage context but not the specific service registration time.

Answer

SRUM (System Resource Usage Monitor) database

Answer

Amcache.hve inventory entry for the service executable

Answer

Prefetch file for the service executable (e.g., SERVICENAME.EXE-XXXXXXXX.pf)

Question 15

During a compromise investigation, an analyst reviews Windows Event Logs and observes that Security Event ID 4688 entries are present, but the Process Command Line field is empty for all of them. The system is running Windows 10 Enterprise. What is the most likely reason for the missing command line data?

Accepted Answer

The 'Include command line in process creation events' policy under Administrative Templates\System\Audit Process Creation is not enabled.. The correct answer is the policy that controls command-line inclusion in process creation events. When enabled, it populates the Process Command Line field in Event ID 4688. Without it, the field remains empty. This is a common pitfall because process creation auditing alone does not guarantee command-line visibility; the separate policy must be turned on.

Answer

The Security log has wrapped, and older entries containing command lines were overwritten before collection.

Answer

The Windows Event Log service is configured to filter out command-line data for privacy reasons via a built-in security template.

Answer

Process creation auditing is not enabled at all, so Event ID 4688 should not appear.