GCFA Windows Artifact Analysis — Timed 20 Questions

Question 1

An analyst discovers a suspicious executable in a user's AppData folder. Which Windows artifact should be examined first to determine if the file was executed via a specific user action or a scheduled task?

20 minute time limit — choose an answer to begin.

Accepted Answer

UserAssist. UserAssist tracks GUI-based application execution, while Prefetch provides execution history regardless of the launch method. To differentiate between user-driven execution and background tasks, an analyst must correlate UserAssist entries with the Task Scheduler logs or Prefetch files. Understanding the launch vector is critical to determining if the activity was manual interaction or automated persistence, which guides the subsequent scope of the investigation into potential lateral movement or malicious automation.

Answer

ShimCache (AppCompatCache)

Answer

Amcache.hve

Answer

SRUM (System Resource Usage Monitor)

Question 2

Which TWO of the following artifacts are most effective for identifying file system activity that occurred immediately before a system shutdown or sudden crash?

Accepted Answer

ShellBags. Analyzing recent file activity requires artifacts that persist across volatile states. The Registry's ShellBags preserve folder view settings, and the RecentDocs key tracks items accessed through the Windows shell. By examining these, analysts can reconstruct the final user actions before a loss of power or system crash. This is vital for incidents involving anti-forensics or attempts to hide evidence by inducing a system failure to prevent proper log flushing.

Answer

Event Log 7040

Answer

SAM Hive

Answer

System Resource Usage Monitor (SRUM)

Question 3

Refer to the exhibit. Based on the USN Journal output, what can the analyst conclude about the file 'secret_data.docx'?

Accepted Answer

The file was created and modified by the user at 14:22:05.. The USN Journal logs low-level modifications to the NTFS volume. The presence of 'FileCreate' followed by 'DataOverwrite' and 'Close' indicates the file was generated and then modified within the same timeframe. This allows an analyst to build a precise sequence of events for a specific file. Understanding these flags is critical for proving data staging or exfiltration activities when other high-level application logs may have been wiped by the adversary.

Answer

The file was deleted immediately after being created.

Answer

The file was moved from a different volume.

Answer

The file is currently open by an active process.

Question 4

An analyst is investigating a compromised system and finds that the 'LastWrite' time of a specific registry key has been modified to match the surrounding keys. Which artifact should be checked to detect this timestomping attempt?

Accepted Answer

USN Journal. Registry keys do not maintain a comprehensive history of modification times, making them vulnerable to timestomping. However, the Transaction Logs (hive transaction files) and the USN Journal record low-level file system and registry transactions. By comparing the high-level registry timestamps with the low-level journal entries, an analyst can detect discrepancies. This is essential for uncovering sophisticated attackers who attempt to blend in by falsifying temporal evidence during a post-exploitation phase.

Answer

Prefetch files

Answer

Windows Event Logs

Answer

ShimCache

Question 5

Which THREE pieces of information can be extracted from a parsed Windows 'Jump List' artifact?

Accepted Answer

The full path of the accessed file. Jump Lists are essential for understanding user interaction with specific applications. They record recently accessed files, pinned items, and the application ID associated with those objects. By analyzing these, an analyst can determine if a user opened sensitive documents or used specific tools, providing a window into their recent workflow. This artifact is a primary target for evidence of data exfiltration, as it captures the file paths and access times of opened documents.

Answer

The user's password hash

Answer

The system's BIOS version

Question 6

An analyst is investigating an unauthorized remote connection. Which artifact, located in the SYSTEM hive, provides evidence of network interface configuration changes that might indicate an attacker-controlled VPN or bridge?

Accepted Answer

NetworkList Key. The Windows registry maintains a detailed history of network configuration in the 'NetworkList' key. Changes here can signify the introduction of new network adapters or VPN configurations that could facilitate unauthorized remote access. Detecting these changes is crucial for understanding how an attacker maintained persistence or bypassed network security controls, as it provides a clear temporal record of when the network environment was modified to support their malicious activity.

Answer

Software Hive (Services)

Answer

SAM Hive

Answer

Amcache.hve

Question 7

Refer to the exhibit. An attacker modified the SpecialPollInterval value. What is the primary forensic implication of this change on a compromised system?

Accepted Answer

The system clock accuracy is compromised for log correlation.. Modifying the NTP poll interval is a common technique used by attackers to de-synchronize the system clock or force frequent synchronization, which can interfere with the accuracy of log timestamps. Forensic integrity relies on accurate timekeeping for timeline analysis. If an attacker tampers with time synchronization, they can effectively hide their activity by shifting the perceived time of events, potentially invalidating evidence or causing correlation failures across logs.

Answer

The system will automatically reboot every hour.

Answer

The registry key change triggers a System Audit log.

Answer

The system will be unable to connect to the domain.

Question 8

Which THREE artifacts are essential for identifying the presence and execution of 'Living off the Land' (LotL) binaries like PowerShell or WMI on a Windows host?

Accepted Answer

Prefetch files. LotL attacks utilize trusted system tools to perform malicious actions, making them difficult to detect. Prefetch files capture command-line arguments for executed processes, while the Security Event Logs (specifically 4688) provide detailed process creation events. Finally, the Amcache.hve can provide metadata about the versions of these binaries. Together, these sources allow an analyst to prove that a legitimate tool was used in an illegitimate way, which is central to most modern incident response cases.

Answer

SAM Hive

Answer

Software Hive

Question 9

Refer to the exhibit. What is the significance of the 'LastWrite' time for this specific registry key?

Accepted Answer

It represents the first time the device was connected.. The LastWrite time on an Enum key in the SYSTEM hive indicates when the device was first installed or when its configuration was last updated. This provides a temporal anchor for the device's introduction to the system. Understanding this is critical for scoping the window of opportunity during which data could have been exfiltrated, especially when combined with other artifacts that show user file system activity after this connection timestamp.

Answer

It shows when the file 'Cruzer_Glide' was last run.

Answer

It indicates the time the device was safely removed.

Answer

It confirms that the user deleted the device driver.

Question 10

When reviewing 'ShimCache' (AppCompatCache), what does an entry with an empty 'Last Modified' time suggest to an investigator?

Accepted Answer

The file was executed but not properly cached.. ShimCache is a memory-resident structure that is written to the SYSTEM hive upon system shutdown. An entry with an empty or null 'Last Modified' time often indicates that the file was executed, but the system did not complete a clean shutdown, or the entry was part of a memory-only process that never successfully committed its metadata to the hive. This is a critical indicator of potential system instability or a forced power-off event.

Answer

The file was executed from a network share.

Answer

The file is a system binary protected by Windows.

Answer

The file was recently deleted from the system.

Question 11

Which Windows artifact should an analyst investigate to identify the specific time a user last modified a local folder's view settings?

Accepted Answer

ShellBags. ShellBags are stored in the USRCLASS.DAT hive and are specifically designed to preserve the folder view settings, such as icon size and window position. Because these settings are updated every time a user navigates into a folder, ShellBags provide a continuous record of directory access. This is essential for reconstructing user activity patterns and proving that a user navigated into specific folders that they claimed never to have accessed.

Answer

NTUSER.DAT RecentDocs

Answer

Prefetch files

Answer

Amcache.hve

Question 12

Which TWO of the following artifacts are most reliable for determining user-initiated file execution on a Windows 10 system?

Accepted Answer

UserAssist. UserAssist and Prefetch are the most reliable indicators of user-initiated execution. UserAssist tracks GUI-launched programs, providing a count and last execution time, while Prefetch creates files specifically to speed up application startup. These artifacts together offer a comprehensive view of execution history, allowing investigators to distinguish between system-level background processes and files directly launched by a user during a suspected security incident or system compromise.

Answer

Shimcache

Answer

Amcache

Answer

Registry 'Run' Keys

Question 13

Which THREE of the following items are commonly found within the Windows Prefetch file structure?

Accepted Answer

Execution counter. Prefetch files are designed to optimize application launch. They store the file path, execution count, last run times, and a list of files or directories loaded by the executable during the first ten seconds of execution. This data is invaluable for digital forensics as it confirms program execution, identifies dependencies used by the malware, and provides a timeline of activity for specific applications discovered during the investigation.

Answer

User security identifier (SID)

Answer

Registry key path modification

Question 14

What is the primary forensic value of the Amcache.hve hive when investigating software installation on Windows 10?

Accepted Answer

It provides the SHA1 hash of the executed file.. Amcache.hve is a registry hive that stores information about executed applications, including file paths, SHA1 hashes, and compilation timestamps. It is highly effective for identifying software that has been removed from the system, as the entries often persist even after the corresponding binary is deleted. This makes it an essential tool for recovering evidence of malicious tools that an attacker may have attempted to clean up after their activity.

Answer

It stores user credentials used during application launch.

Answer

It tracks the exact network connections made by an application.

Answer

It records the full command-line arguments used for execution.

Question 15

Which THREE of the following items can typically be extracted from a LNK file during a forensic investigation?

Accepted Answer

Volume Serial Number of the target drive. LNK files are shortcuts that contain metadata about the target file they point to. They include the original file path, volume serial number, MAC addresses, and modification timestamps of the target object. This information is crucial for proving that a user had access to specific files, even if those files were on external media, and helps correlate user actions with the presence of suspicious data on the system.

Answer

The user's password hash

Answer

Full contents of the target file

Question 16

An analyst is investigating a Windows 10 system where an attacker used PowerShell to download and execute a malicious script. The analyst wants to determine the PowerShell command-line arguments and script block content that were executed. Which TWO artifacts should the analyst examine to recover this information? (Choose two.)

Accepted Answer

Windows Security event log Event ID 4688 with command-line auditing enabled. To recover both command-line arguments and script block content, the analyst needs Security Event ID 4688 with command-line auditing for the arguments, and PowerShell Operational Event ID 4104 for the script block content. These two artifacts together provide the full picture of what was executed. Other logs may offer partial information but do not cover both aspects as directly.

Answer

Sysmon Event ID 1 (Process Creation)

Answer

PowerShell ConsoleHost_history.txt file

Answer

PowerShell Operational log Event ID 4103

Question 17

An analyst is examining a Windows 10 workstation that is suspected of being used to exfiltrate data via a user-installed cloud-sync client. The analyst wants to correlate the exact times when files were added to a synced folder with network activity. Which Windows artifact should the analyst examine first to obtain the most direct record of individual file operations performed by that application?

Accepted Answer

The Microsoft-Windows-CloudFiles Operational event log. The Cloud Files Operational log is generated by the cloud-sync service and captures file-level operations such as hydration and dehydration. Because it attributes each operation to the sync engine, it directly supports correlating file additions with the client's network activity. The USN journal lacks process attribution, the $MFT lacks operation detail, and Prefetch only shows execution, not file-level actions.

Answer

The NTFS $UsnJrnl:$J alternate data stream

Answer

The $MFT record for the synced folder

Answer

The Prefetch file for the cloud-sync client executable

Question 18

An analyst is examining a Windows 10 system for evidence of a file that was recently deleted. The analyst suspects the file was removed using a command-line tool. Which artifact should be examined to determine the original path and deletion time of the file, assuming the file was deleted from an NTFS volume?

Accepted Answer

$MFT and $UsnJrnl:$J. The correct answer combines the $MFT and $UsnJrnl:$J. The $MFT provides the file record, including parent directory references and timestamps, while the $UsnJrnl:$J logs the deletion event with a timestamp. When correlated, they can reveal the original path and deletion time. This approach is standard for NTFS forensic analysis, especially when the Recycle Bin is bypassed.

Answer

$MFT and $LogFile

Answer

$Recycle.Bin and $I files

Answer

$UsnJrnl:$J

Question 19

An analyst is examining a Windows 10 system suspected of being compromised. The analyst finds that the file `C:\Windows\System32\winevt\Logs\Security.evtx` has been deleted. A quick check of the volume shadow copies shows no recent copies. Which artifact should the analyst examine next to determine if the Security event log was cleared, and to recover potentially relevant event records?

Accepted Answer

The Windows Event Log's 'Event ID 1102' in the Security log, if the log was cleared before deletion. Event ID 1102 in the Security log is the definitive indicator that the Security audit log was cleared. Even if the log file is deleted, the analyst should attempt to recover it or look for forwarded copies. Other options incorrectly attribute log clearing events to the System log or suggest NTFS metadata that does not contain event log data.

Answer

The Windows Event Log service's 'Event ID 1102' in the System log

Answer

The 'Event ID 104' in the System log indicating log clearing

Answer

The $LogFile metadata file in the NTFS volume

Question 20

An analyst is examining a Windows 10 system and wants to determine which user account was used to run a specific program that left a prefetch file. The prefetch file is named NOTEPAD.EXE-1A2B3C4D.pf. Which artifact should the analyst examine to correlate the prefetch execution with a user account?

Accepted Answer

Security event log Event ID 4688 with user account information. Security Event ID 4688 records process creation with the user account SID, allowing direct correlation with a prefetch file's execution timestamp and process name. This event is the most reliable artifact for attributing a specific program execution to a user account. Other artifacts like UserAssist or SRUM may indicate user activity but do not provide the same direct linkage to a specific prefetch file.

Answer

Amcache.hve

Answer

UserAssist registry key

Answer

SRUM database