GIAC Certified Forensic Analyst (GCFA) — Questions 151–225

A resident $DATA attribute means the file's content is small enough to fit inside the MFT record. When the file is deleted, the record is marked as free but the data remains until the record is reallocated. Therefore, the content may still be recoverable by parsing the MFT entry.

Moving or copying a file creates a new entry in the file system, which results in a new birth timestamp. This destroys the original creation evidence, making the birth time useless for determining when the file first arrived on the system if it has been moved or copied by the attacker.

Recovery is the phase where systems are restored, patches are applied, and security controls are validated to ensure the environment is safe for business operations. This step ensures that the root cause is addressed and that no residual access or persistence mechanisms remain that could allow the adversary to regain control.

Explorer.exe runs in the interactive user's context, and its primary token contains the user SID of that account. Parsing the token from explorer.exe's EPROCESS in memory reveals the interactive user. This is a standard technique in memory forensics for attributing activity to a specific logged-on user when no other session artifacts are available.

The .lnk file (shortcut) contains a LinkTargetIDList and other structures that store the original target path, as well as command-line arguments if present. By parsing the .lnk file, the analyst can extract the full path and any arguments, making it the correct artifact for this purpose.

The cmdline plugin specifically retrieves the command-line arguments from the process's PEB (Process Environment Block). This provides the full string used to start the process, which often includes malicious paths, obfuscated arguments, or external command-and-control parameters that are vital for forensic analysis of the execution.

The $Bitmap file tracks cluster allocation. Even if the MFT entry is unallocated, the clusters may still be free. Checking $Bitmap confirms whether the data runs point to allocated clusters. If the clusters are free, recovery is likely; if allocated, the content may be partially or fully overwritten.

The SAM registry hive stores local user account information, including usernames, password hashes, and account creation dates. Analyzing the SAM hive can reveal the presence of the newly created local account, even if event logs have been cleared. It provides a persistent record of the account's existence and attributes.

Domain controllers should have strictly controlled outbound traffic profiles. An established connection to an arbitrary external IP address from a core infrastructure process like svchost is a classic indicator of compromise, suggesting the system is acting as a pivot or is participating in a command-and-control communication channel.

Memory pages with Read, Write, and Execute (RWX) permissions are rare in legitimate software. These permissions are often a requirement for self-modifying code or injected payloads, making them a primary target for finding malicious code that needs to both write its payload and subsequently execute it.

NTFS directories store index entries in $INDEX_ROOT and $INDEX_ALLOCATION attributes. These entries map file names to their MFT record numbers. By traversing the directory hierarchy, an examiner can resolve the full path to the file's MFT record number. This is the correct method for path-to-record resolution.

Explorer.exe is typically launched by userinit.exe during the login sequence. When svchost.exe, a process intended for background system services, spawns the shell, it indicates that the system has been compromised. This violation of established process lineage is a primary indicator of process injection or hollowing.

Resident data is stored within the MFT record itself, avoiding the need for cluster allocation. This is an optimization for small files (typically under 700-900 bytes). For forensic analysts, this means the file content is immediately available once the MFT record is parsed, without needing cluster map traversal.

mtime records the last time the file's content was modified. In ext4, any write to the file data updates mtime, making it the correct timestamp for determining when the content last changed. This directly answers the investigator's question about content modification time, assuming no timestamp manipulation has occurred.

The MFT stores the attributes for every file on an NTFS volume. The 'Hidden' attribute flag, when set, instructs the operating system to omit the file from standard folder views. Identifying this flag is essential for uncovering files that the attacker intentionally obscured from the user.

A process that is missing from the active process list but still discoverable by a pool scan indicates that its list entry was removed, a technique known as DKOM. This is a hallmark of rootkit activity, because legitimate processes are not unlinked from the active list while they are running, and the pool scan finds the object because the structure itself remains allocated.

By limiting the permissions of an IR account to exactly what is needed—such as log reading or forensic disk access—the organization mitigates the risk of credential theft. This practice ensures that even if an account is compromised, the attacker is limited in their ability to escalate or expand their foothold.

A system call hooking rootkit often manipulates the output of tools like ps by intercepting system calls. However, the /proc file system is maintained by the kernel and may still contain entries for hidden processes. Comparing ps output with the contents of /proc can reveal discrepancies where processes exist in /proc but are not shown by ps, indicating rootkit activity.

This is correct because the $MFT retains entries for deleted files until they are overwritten. When a file is deleted, its MFT record is marked as unallocated, but the record content, including timestamps and file name, often remains intact. The Sleuth Kit's fls tool can parse these unallocated entries and include them in the bodyfile, resulting in timeline entries for files that no longer exist. These entries are valuable because they indicate past file presence and can be used to reconstruct historical activity, and the data may still be recoverable if the clusters have not been reused.

Hashing the image right after acquisition creates a verifiable baseline for integrity. Any later comparison can confirm the image is unchanged. This is a fundamental forensic practice that supports admissibility and defensibility, and it applies directly to memory images just as it does to disk images, ensuring the evidence can be trusted throughout the investigation.

The MFT Change timestamp reflects the last time the file's MFT record metadata was modified. This includes operations like renaming, changing permissions, or moving the file. It is a distinct temporal artifact from the file content modification time and provides critical context for structural changes to the file system.

The repeated failures followed by a success from the same source IP describe a successful brute-force or password-guessing attack. The subsequent sudo invocation that adds a user to sudoers is a classic privilege escalation and persistence step, since it creates a second account with administrative rights. Both events, tied to the same session, form a coherent intrusion chain.

The windows.modules plugin parses the kernel's module list (PsLoadedModuleList) and outputs each loaded driver, including its base address, size, and full path. This directly satisfies the requirement to enumerate kernel modules from a memory image and compare against the OS-reported list for discrepancies.

DKOM lets malware unlink an EPROCESS entry from the active process doubly-linked list, so Volatility 3's list-walk traversal cannot reach it. The processes remain resident in memory, which is why the stem's aggressive kernel driver acquisition still captured them but standard enumeration missed them.

Executable memory regions that are marked as Read-Write-Execute (RWX) are highly suspicious. Legitimate processes rarely require memory to be writable and executable simultaneously. Attackers often use these permissions to write shellcode to a buffer and then execute it, making this a primary indicator of process injection.

Timestomping is the intentional modification of file metadata to mislead investigators. By altering the SI attributes, an attacker hides the true age of a malicious file, making it appear as a legitimate system file or part of a different time window, which is a direct attack on forensic timeline integrity.

Moving a file within the same NTFS volume reuses the existing MFT record, updating only the parent directory references and ctime. Conversely, copying allocates a completely new MFT record, assigning a fresh creation timestamp to the destination file.

User-space anti-forensic tools typically modify only the easily accessible $STANDARD_INFORMATION attribute. Because the NTFS kernel driver maintains the $FILE_NAME attribute during standard renaming and creation actions, the older $FILE_NAME timestamp frequently survives, exposing the tampering attempt to investigators.

RFC 3227 specifies order of volatility: memory and network state are more volatile than process table and disk. Collecting memory first preserves the most perishable evidence. Network connections and running processes change rapidly, but memory is lost entirely upon shutdown, so it must be captured before other artifacts. Disk is least volatile and can be collected later.

windows.handles enumerates the handle table of each process and shows the object type and object name. Filtering for lsass.exe reveals which processes held handles to the LSASS process object, providing direct evidence of access at capture time. This is the most targeted way to identify a process that opened LSASS for memory access.

Copying a file to a new NTFS destination assigns a fresh creation timestamp representing the exact moment of creation on the target volume. However, the modified timestamp is often preserved from the source file, creating an apparent chronological inversion that immediately flags the file as a copy.

windows.modules parses the kernel's PsLoadedModuleList to enumerate loaded kernel drivers and modules, reporting their names, base addresses, and sizes. This directly supports building a baseline comparison for rootkit detection. The plugin works on Windows memory images and is the standard Volatility 3 replacement for the legacy Volatility 2 modlist plugin.

windows.psscan scans physical memory for process objects, including those that have been terminated but not yet overwritten. It can find residual process structures that are no longer in the active process list. This makes it the correct plugin to identify terminated processes that may still have forensic artifacts in memory.

Memory dumps of the injected process can reveal the presence of the malicious DLL in the process's address space. Tools like Volatility's malfind or dlllist can detect injected code by looking for memory regions with unusual permissions or unlinked DLLs. This is the most direct evidence of DLL injection.

The malfind plugin identifies memory regions that are both executable and private (not mapped to a file on disk). This is a strong indicator of injected code, as most legitimate executables are backed by files. It is the go-to tool for finding shellcode and non-persistent malicious code running in memory.

Event ID 4624 captures successful logons. During a Pass-the-Hash attack, the analyst looks for anomalous authentication patterns, such as the use of NTLM for logons that should be Kerberos, or logins occurring from systems that do not usually communicate with the target, indicating the reuse of intercepted hashes.

The $ATTRIBUTE_LIST attribute is used when a file's attributes exceed the space available in a single MFT record. It lists the attributes and their locations, which may be in additional MFT records. This allows NTFS to manage files with many attributes or large attributes that cannot be stored in one record. This is the primary purpose of the $ATTRIBUTE_LIST.

The process security token is a kernel object that represents the user's security context. It contains the SIDs for the user and their groups, which directly indicate the account identity that owns the process, providing the necessary evidence for identifying which user account executed the malware.

The SYSTEM registry hive contains the Services subkey under CurrentControlSet, which stores service configuration including the ImagePath, Start type, and ObjectName. This is the authoritative source for service persistence. Examining it directly reveals malicious services even if the Service Control Manager database is cleared or the service is set to disabled, making it the first artifact to check.

TCP Endpoint structures in memory store the state of all active and listening network connections, including the associated process ID. By parsing these structures from a memory dump, an analyst can definitively link network traffic to a specific, potentially malicious process, regardless of whether the connection is hidden from standard OS tools.

All observed attributes — namespace, executable path, argument, owner, and timestamp — align with a standard Edge updater installation. Because scheduled tasks are a common persistence mechanism, best practice is to confirm the binary is signed by Microsoft and that the timestamp matches the known Edge install baseline. This combination of corroboration supports a benign classification while still applying forensic rigor.

Event 4697 tracks service installation. Attackers often install services to maintain persistence, ensuring their malware runs with high privileges after a reboot. Detecting this event allows the investigator to extract the service path and identify the malicious binary that was dropped and registered for automatic execution.

Invoke-Expression (IEX) allows PowerShell to execute strings as commands. Downloading a script from a URL and piping it to IEX is a common 'fileless' attack technique. This avoids writing the malicious script to disk, making it difficult for traditional file-based antivirus to detect or analyze the payload.

Executable and writable memory that has no file backing is a classic indicator of injected code, because legitimate executables and DLLs are normally mapped from disk with read-only or execute-only protections. The combination of writability, executability, and no on-disk source strongly suggests an attacker allocated memory and wrote shellcode or a payload into it.

The SSDT contains an array of function pointers that define the kernel services available to user applications. Malware frequently overwrites these pointers to redirect execution flow to malicious code, allowing for the subversion of system APIs without triggering traditional file-based detection mechanisms during memory forensics analysis.

$FILE_NAME timestamps are updated by the file system during filename operations and are not directly modifiable by user-mode APIs. They often retain original values even when $STANDARD_INFORMATION is altered. Comparing these with $STANDARD_INFORMATION can expose timestomping. In this scenario, they are a key artifact for detecting inconsistencies.

When a file is deleted, its MFT record is marked inactive but not immediately wiped; a new file with the same name receives a different record number. The stale record may retain a zero-length $DATA or residual attributes, while the new record holds the active data and an $OBJECT_ID assigned at creation, explaining the duplicate filename across two records.

The 'File_Create' event followed by the 'Data_Extend' event demonstrates that the file was initialized on the file system and then subsequently received data. This sequential logging is characteristic of standard file write operations performed by applications or the operating system, providing a clear timeline of file usage.

Event ID 6006 in the System log indicates that the event log service was stopped, which occurs during a clean shutdown. It is a reliable indicator of a graceful system shutdown. The timestamp of this event provides the time the shutdown process completed. This is the standard event used to determine shutdown time.

A resident $DATA attribute means the file's content is small enough to fit within the MFT record, typically under approximately 700 bytes. The data is stored directly in the MFT entry, so the analyst can extract it by parsing the MFT record. This is a straightforward recovery because no cluster allocation or disk carving is required.

Record 0 is the $MFT's own file record. Its timestamps reflect changes to the MFT itself, such as when entries are added or removed, or when the MFT is extended. Including it in a timeline can help identify periods of significant file system activity or potential anti-forensic manipulation of the MFT.

Email gateway logs record all inbound and outbound email messages, including sender, recipient, subject, and attachment details. If the adversary used a phishing email with a malicious attachment, the gateway logs would show the delivery of that email, possibly with attachment names and hashes. This is the most direct evidence of the initial infection vector, allowing responders to trace the email back to the sender and identify other recipients.

A high volume of 4625 events signifies repeated failed authentication attempts, which is the textbook definition of a brute-force or password-spraying attack. Locking the account and investigating the source IP is the standard and necessary incident response procedure to mitigate the risk of credential compromise in this scenario.

ShellBags registry keys are updated when a user opens a folder. Because these keys persist even after folders are deleted, they are excellent evidence for showing the user was present in a directory. This helps confirm user knowledge of specific files or directories during a forensic examination.

Event ID 4624 provides the critical context of how the user logged in, specifically via the Logon Type field. This allows investigators to differentiate between local interactive sessions and remote network sessions, which is essential for identifying unauthorized lateral movement across the domain during an incident investigation.

The Logon Process and Authentication Package fields distinguish a network logon initiated by a service (for example, NTLM or Kerberos via a service host) from an interactive or explicit credential use. A mismatch, such as an unexpected authentication package or logon process for that account, is a strong indicator of credential misuse for lateral movement rather than normal service behavior.

The $FILE_NAME attribute in the MFT records a timestamp that is updated when a filename is created or changed on the volume. For a copied or renamed file, this timestamp can reflect the time the filename entry was established, which may differ from the $STANDARD_INFORMATION creation time. In this scenario, it is the appropriate artifact to check for the filename creation event around 14:00.

This policy, when enabled, configures Windows to include the full command line in Event ID 4688 process creation events. Without it, the command line field is blank. Enabling it ensures future events capture this critical detail for forensic analysis.

Timestomping tools commonly modify $STANDARD_INFORMATION timestamps because they are writable via user-mode APIs, while $FILE_NAME timestamps are harder to alter and often retain the true creation and modification periods. When $STANDARD_INFORMATION predates the OS installation and $FILE_NAME matches the actual activity window, the defensible conclusion is deliberate timestamp manipulation of $STANDARD_INFORMATION.

Event ID 4688 records the creation of a new process and includes the creator process name. Here, cmd.exe is the creator of powershell.exe. This parent-child relationship is a common technique in malicious scripts, such as those used in fileless attacks or lateral movement. It does not prove maliciousness but is a suspicious pattern that warrants further investigation. This option accurately describes the event.

The Unified Audit Log in the Microsoft 365 compliance center records mailbox access, rule creation, and other tenant activities across services. Exporting and filtering it for events such as New-InboxRule and MailItemsAccessed provides the authoritative, tenant-wide record needed to determine the full scope of the adversary's mailbox actions.

windows.ssdt parses the System Service Dispatch Table and compares each entry to the expected function based on the kernel module's export table, flagging entries that point outside the owning module. This directly detects SSDT hooks used by rootkits. It is the correct plugin for identifying hooked system service functions in this scenario.

The USN Journal logs every change made to files and directories on the volume. By parsing this file, investigators can reconstruct a timeline of events even if the original files were deleted. It is a critical artifact for understanding the sequence of events during a security incident.

Sysmon event ID 10 logs process access events. When the target is lsass.exe and the granted access mask includes rights like PROCESS_VM_READ and PROCESS_QUERY_INFORMATION (commonly 0x1010 or 0x1410), it strongly indicates an attempt to read LSASS memory, which is a hallmark of credential dumping tools such as Mimikatz.

The MFT record header contains an in-use flag that NTFS sets to 0 when a file is deleted, marking the record as unallocated. This is a primary indicator that the file no longer exists in the active file system. The analyst can parse this flag directly from the MFT record to confirm the file's deletion state, independent of other metadata.

INDX records in the $INDEX_ALLOCATION contain index entries and often retain stale or slack entries after a file is deleted. These residual entries can include the filename and file reference of a deleted file. Analyzing the slack space of these INDX records is a standard technique to recover evidence of deleted files from a directory index.

Both attributes hold creation, modification, MFT change, and access times. Because they are updated by different code paths, discrepancies between them can indicate timestomping or a file move or rename, making both sets valuable for a defensible timeline.

Event ID 4624 is logged when a logon attempt succeeds. It includes the logon type, which indicates the type of logon (e.g., interactive, network, batch). For interactive logons, the logon type is 2 (Interactive) or 10 (RemoteInteractive). By filtering for these logon types and the specific user, the analyst can determine the last interactive logon time.

A memory dump captures the full contents of a process's virtual address space, including loaded modules, heaps, stacks, and any injected code. By analyzing the dump with tools like Volatility or WinDbg, you can identify memory regions that are not backed by a file on disk (e.g., PAGE_EXECUTE_READWRITE) and detect reflective DLL injection. This directly addresses the need to find anomalous memory regions.

Chain of custody documentation is essential for admissibility. It records the who, what, when, where, and why of evidence collection and transfer. Without proper documentation, the evidence can be challenged as tampered or unauthenticated. This is the most critical step to maintain integrity and admissibility.

In Windows, when a parent process terminates, its child processes are not terminated. The PPID of a child remains pointing to the now-defunct parent PID. Since PID 1234 is not in the active process list, it likely terminated, leaving a stale PPID. This is a common forensic artifact and does not necessarily indicate malicious activity.

Security Event ID 4624 with Logon Type 3 indicates a network logon, which occurs when a user accesses a remote share. It records the account name, logon time, and source network address. This directly evidences remote file share access, making it a primary artifact for the scenario.

The windows.vadinfo plugin lists virtual address descriptors (VADs) for a process, showing memory regions and their protections. It helps identify unusual memory allocations, such as those with execute permissions that are not backed by a file, which are indicative of injected code. It complements malfind by providing detailed VAD information.

windows.psscan uses pool tag scanning to find EPROCESS structures regardless of whether they are linked in the active list. If a process appears in psscan but not pslist, it suggests the process was unlinked, a common rootkit technique. This discrepancy is a key indicator of hidden processes, making this statement correct.

Live acquisition tools such as FTK Imager or Magnet ACQUIRE can create a forensic image of the disk without taking the server offline. They capture the disk contents while the system is running, minimizing disruption. This is the most appropriate method for a critical server that cannot be shut down, though it may not capture volatile data, so that should be collected separately.