GIAC Certified Forensic Analyst (GCFA) — Questions 226–292

Physical memory is the most volatile evidence and contains running processes, network connections, and encryption keys. Capturing it first preserves data that would be lost on shutdown or reboot. Tools like WinPmem or DumpIt create a forensic image of RAM that can later be analyzed for artifacts not found on disk, making this a critical first step in volatile evidence collection.

The MFT acts as the central index of the NTFS file system. It contains critical metadata like timestamps and data pointers for every file. This is the foundation of digital forensic file analysis, enabling investigators to recover evidence of files, even after they have been deleted by users.

Unbacked memory regions with PAGE_EXECUTE_READWRITE and MZ headers are classic signs of code injection. Legitimate executables and DLLs are backed by files on disk. The absence of a file mapping indicates the code was placed directly into memory, often by process injection techniques. This is a key finding in fileless malware investigations and warrants further analysis of the injected content.

Prefetch files are created when an executable is run, and they record execution time and run count. If a Prefetch file exists for the malicious executable, it confirms that the program was executed on the system. ShimCache only indicates that the file was present and may have been executed, so Prefetch provides the necessary confirmation.

windows.psscan scans physical memory for process objects using pool tag scanning, independent of the active process list. A rootkit that unlinks a process from the list will hide it from windows.pslist, but the process object may still reside in memory and be detected by windows.psscan. Therefore, windows.psscan is likely to show more processes, revealing the hidden one.

In process hollowing, the original executable is created in a suspended state, its memory is unmapped, and malicious code is injected. The in-memory image path (from the PEB) may still point to the original file, but the actual code in memory is different. A mismatch between the in-memory image path and the on-disk file path, or a discrepancy in the code, is a strong indicator. This is often detected by comparing the in-memory module with the disk file.

DATA_OVERWRITE (0x00000100) indicates that data in the file was overwritten at the recorded time. Because the USN journal is written when the change occurs, this record is a reliable anchor for content modification on the timeline, assuming the journal has not wrapped and overwritten older records.

The connection is from a legitimate process (chrome.exe) to a remote IP on port 443, which is common for HTTPS traffic. However, malware can inject into legitimate processes or use them to communicate with command-and-control servers. Correlating the IP with threat intelligence and examining the process memory for anomalies (e.g., injected code, suspicious strings) is the logical next step to determine if the connection is malicious. This approach balances the need to investigate without assuming benign or malicious.

The .automaticDestinations-ms extension is used for the files stored in the AutomaticDestinations folder. These files contain lists of recently accessed items for a specific application. Identifying these files allows an analyst to extract document names, folder paths, and timestamps related to the user's recent file interaction history.

$DATA contains either the data itself (if resident) or the data runs (if non-resident). Data runs provide the logical-to-physical mapping required for the OS to retrieve file data from the disk clusters. This is the core attribute for mapping file content to disk-level storage locations.

Super-timelines aggregate thousands of events, most of which are benign OS background tasks. Effective filtering narrows the scope to relevant timeframes or specific file types, enabling the analyst to quickly identify meaningful patterns of attacker behavior that would otherwise be obscured by the sheer volume of normal operating activity.

Windows Event Logs, particularly Security, System, and Application logs, record logon events, service installations, and process creation (with appropriate auditing). They provide timestamps and details necessary for building a comprehensive timeline of adversary activity across multiple event types.

windows.threads lists all threads for a given process, including thread IDs, start addresses, and stack information. This allows an analyst to identify threads whose start addresses fall outside the normal module range, which is a strong indicator of code injection. It directly addresses the requirement to examine threads and their start addresses in volatile memory, making it the correct choice.

Access times are updated by nearly any process that reads a file, including security software, search indexers, and background tasks. This makes it impossible to distinguish between a malicious user accessing a document and a background service performing a routine scan, rendering the timestamp unreliable for proving intentional user interaction.

The Windows kernel scheduler relies on thread objects to allocate CPU time. Since the kernel must track every active thread to function, comparing the thread list against the EPROCESS list allows an analyst to find processes that have unlinked themselves from the active process list but are still running.

The $ATTRIBUTE_LIST attribute is used when a file has many attributes or large attributes that cannot fit in the base MFT record. It lists the attributes and indicates whether they are resident in the base record or in an extension MFT record. This allows NTFS to locate all attributes of a file across multiple MFT records.

The psscan plugin searches for EPROCESS objects by scanning memory for specific pool tags. This method does not rely on the integrity of the linked list pointers, making it highly effective at finding processes that have been unlinked or hidden by malicious kernel-mode activity during the investigation.

Network isolation via switch ACLs or EDR containment stops lateral spread and command-and-control communication while preserving volatile memory, running processes, and active sessions for forensic capture. It maintains system state for memory acquisition and allows the team to collect live evidence before any shutdown, satisfying both containment and preservation goals.

In NTFS, a non-resident $DATA attribute can have a logical size of 0 while still having allocated clusters if the file was truncated or if data was written and then the size was reset without deallocating clusters. This can be used to hide data in allocated clusters that are not reflected in the file size. Forensic tools can examine the data runs to recover such hidden data.

The pattern of many failed SSH logins followed by a successful one is characteristic of a brute-force attack. The attacker likely used a tool like Hydra or Medusa to guess credentials. The successful login indicates that the attacker gained access, which is a critical security incident. The responder should investigate the source IP, check for additional compromised accounts, and review what the attacker did after logging in.

Event ID 4104 in the Windows PowerShell operational log records the actual script block text when Script Block Logging is enabled. This directly captures the PowerShell code that was executed, including obfuscated or dynamically generated content, making it the most direct source for reconstructing the malicious script block. It is not enabled by default, so its presence indicates prior configuration.

Time skew represents the drift or offset of a system clock compared to an accurate reference time. It is a critical factor for forensic analysts to document; failing to account for it will result in an incorrect sequence of events when comparing the evidence against other system logs or external timestamps.

PAGE_EXECUTE_READWRITE memory containing a PE header and not backed by a file is a classic indicator of code injection. Malware often uses techniques like reflective DLL injection or process hollowing to execute code within a legitimate process. The lack of file backing means the code was not loaded from disk, further supporting malicious injection.

The USN change journal records file system events with reason flags such as RENAME_OLD_NAME and RENAME_NEW_NAME, and each record includes the filename at the time of the event. Querying $UsnJrnl:$J can reveal the prior name and the sequence of renames, which the $STANDARD_INFORMATION timestamps alone cannot show.

Event ID 4624 with Logon Type 2 indicates an interactive logon at the console, recorded in the Security log at the moment the session was established. In this scenario it directly ties a specific account to a physical or console session, making it the most reliable artifact for confirming who was actively logged in at the time of the incident.

Orphaned processes occur when the parent process has terminated. In forensic analysis, this is frequently seen with malware that uses a launcher process to execute a payload and then exits. It serves as a significant indicator of potential malicious activity, warranting a deeper look at the process's creation time.

Performance tuning options like relatime update access times only if the previous access time is older than the modification time or if it has been over a day. This intentional kernel behavior hides casual file reads, undermining traditional timeline analysis techniques used in incident response.

The VAD tree describes each memory region mapped into the process, including private committed pages and mapped image sections. Injected code often appears as a private, executable region not backed by a file on disk. Analyzing VAD nodes and their page protections reveals suspicious executable regions and can identify the originating module even if the file was deleted.

The $UsnJrnl is designed to track volume changes for administrative purposes, leading to a much larger storage capacity compared to the circular, high-frequency $LogFile. This allows analysts to view long-term trends and historical file operations, which is crucial for reconstructive analysis during an incident response engagement.

If a file's non-resident $DATA attribute points to clusters that are currently allocated to another file, this indicates an inconsistency in the file system metadata. This can occur from disk corruption, software bugs, or deliberate tampering. It is not a normal state for any standard NTFS feature.

Event ID 4104 logs the script block content executed by the PowerShell engine. This is the primary event for forensic analysis of PowerShell activity, as it captures the full script, including base64-encoded commands, allowing analysts to decode and analyze the malicious logic used in fileless attacks.

windows.modscan scans kernel pool memory for module structures and can identify modules that were loaded and later unloaded, because their metadata may remain in pool even after removal from the active module list. This directly addresses the need to find previously loaded drivers that are no longer active, making it the correct plugin for this scenario.

Logon Type 10 is the specific identifier for Remote Interactive logins, typically associated with RDP connections. This is the primary forensic artifact used to distinguish human-driven remote access from automated system tasks or background service authentication, which use different logon types within the Windows event auditing subsystem.

The Windows API follows a doubly-linked list of process objects to enumerate running programs. By removing the process node from this list, a rootkit makes the process invisible to any tool using the API, even though the process continues to run because the scheduler still tracks it.

The 'MZ' signature identifies a portable executable file. Finding this header inside a memory segment that lacks file-backing and is set to RWX permissions confirms that a complete binary payload was injected into the process memory, which is a hallmark of sophisticated process injection attacks.

The MFT record header timestamp is updated when the MFT entry itself is modified, such as when a new attribute is added, an attribute is resized, or the record is moved. Operations like adding an alternate data stream or changing the file's size can update the MFT record header without changing the $STANDARD_INFORMATION or $FILE_NAME timestamps, because those timestamps are stored in the attributes themselves. This explains the discrepancy while all file timestamps remain identical.

Residues of credential-dumping frameworks such as the sekurlsa module strings or the Mimikatz kernel driver can persist in memory after execution and are recoverable from a full memory capture. Finding them demonstrates the tooling was present and loaded on the host, which corroborates that LSASS memory was targeted even if the dumping process has already exited.

NTFS stores timestamps as 64-bit values representing the number of 100-nanosecond intervals since January 1, 1601. When a tool converts these to nanoseconds, it multiplies by 100, which can result in values that appear to have nanosecond precision but are actually limited to 100-nanosecond granularity. The extra digits are an artifact of conversion, not additional precision.

Prefetch files are created when an executable is run, and they record the last execution time and run count. The presence of a prefetch file for POWERSHELL.EXE indicates that PowerShell was executed on the system. The timestamp embedded in the .pf file can be parsed to determine the last execution time, which is valuable for timeline analysis.

The Windows Console Host (conhost.exe) maintains a history buffer of commands entered in a command prompt window. This buffer resides in the memory of the conhost.exe process associated with the console session. Extracting this buffer from a memory image can reveal recently typed commands that may not be recorded in any persistent log, making it a valuable volatile artifact for user activity.

Sysmon Event ID 1 logs detailed process creation events, including the exact UTC timestamp, process GUID, image path, command line, and parent process ID. This directly answers when the process started and its parent-child relationship. If Sysmon was installed and configured, this is the most precise and reliable artifact for the scenario.

Multiple failed logon attempts followed by a successful logon for the same account often indicate a user who forgot their password or made typographical errors. While this could also indicate a brute-force attack, the pattern alone without other indicators (like many different accounts or high volume) is most consistent with normal user error.

The /etc/passwd file contains user account information, with fields separated by colons. The third field is the UID. Searching for ':0:' will match any line where the UID is 0, which is typically only root. This command quickly reveals any additional accounts with root privileges, such as the malicious 'support' account. It is a simple and effective way to detect unauthorized UID 0 accounts.

Sysmon Event ID 3 records outbound network connections with process, source, destination, and port details. Repeated connections to the same external IP at consistent intervals are a hallmark of beaconing and directly evidence command-and-control traffic. Correlating the initiating process image and its hash strengthens the finding, making this one of the most direct artifacts for confirming periodic C2 behavior from the endpoint itself.

windows.handles lists the handles open in each process, including the object type, name, and access rights. For a file handle, it shows the full path and the granted access, which directly answers the question about the file's path and access type. This plugin is specifically designed to enumerate handles, making it the correct choice.

Each MFT entry contains a sequence number that is incremented every time the record is allocated to a different file. By comparing the sequence number observed at acquisition with earlier journal or log entries, an examiner can determine whether the record number has been reused and how many times.

The 'Net.WebClient' class is the standard, built-in way for PowerShell scripts to perform HTTP or HTTPS GET/POST requests to download remote data. In incident response, the presence of this class in a script is a strong indicator of a download-and-execute operation used by attackers to pull secondary malicious payloads.

Any tool executed on a system modifies memory. Minimizing the size and scope of the memory acquisition tool is vital to ensure that the evidence is not corrupted or overwritten. Forensic analysts prioritize tools that have a small footprint to maintain the integrity of the captured image.

Attackers frequently modify the SI attributes to make malicious files appear older or consistent with other system files. Because they often overlook the FN attributes, comparing the two reveals the manipulation. This discrepancy is a standard forensic indicator used to identify hidden files that were created or modified maliciously.

A legitimate Windows system binary like svchost.exe will be signed by Microsoft. If the file in the AppData directory is unsigned, or if the signature is invalid, it is a definitive indicator that the file is not the genuine system binary, regardless of its filename or location.

windows.vadinfo dumps the virtual address descriptor tree for a process, showing each region's protection, commit type, and backing file. When combined with malfind, it lets you characterize the injected region by confirming whether it is private, executable, and fileless, which is essential for describing the injection in this scenario.

Event ID 4698 is generated when a scheduled task is created. It includes the task name, the user account that created it, and a timestamp. This directly answers the question of when the task was registered and who registered it, making it the most reliable artifact for this scenario.

Resident files store their data directly within the MFT record structure when the file size is smaller than the remaining space in the record. This avoids allocating a cluster, effectively keeping the file content embedded within the MFT itself, which forensic analysts must extract directly from the MFT entry.

Normalization maps diverse log formats into a common format, allowing analysts to perform queries that span across different security devices. This consistency is critical for identifying lateral movement or multi-stage attacks where an actor touches multiple systems, ensuring that disparate events can be linked accurately during an incident investigation.

Loading a custom SSP via the registry allows the malicious DLL to be loaded into the LSASS process at boot. This provides the attacker with persistence that is integrated into the Windows authentication flow, allowing them to hook system functions and monitor credentials as they are entered by users.

In ext4, the dtime field records when the inode was deleted or unlinked. When `fls` extracts deleted entries and writes a body file, it includes dtime, and `mactime` renders it as a deletion event. This is why the timeline places dtime entries at the deletion moment, not at a modification time. The colleague's claim confuses dtime with mtime.

windows.pstree displays processes in a hierarchical tree based on parent-child relationships, making it easy to spot anomalies like a svchost.exe with an unexpected parent. It shows the PPID and the actual parent process, helping verify legitimacy. This plugin is ideal for investigating process spoofing by visualizing the process tree.

Timestomping utilities commonly modify the $STANDARD_INFORMATION timestamps because that is what Windows Explorer and many tools display, but they often overlook the $FILE_NAME attribute timestamps, which are updated by the file system during rename or creation events. The three-year-old values in $STANDARD_INFORMATION versus recent $FILE_NAME values strongly indicate deliberate manipulation of the $STANDARD_INFORMATION timestamps.

The TEB contains the TLS array, which is used by threads to store and retrieve data that is unique to that specific thread. Malware often leverages TLS callbacks to execute code before the main entry point, making the inspection of this TEB structure vital for uncovering early-stage malicious execution.

Attackers frequently use -EncodedCommand to obfuscate PowerShell payloads, and -WindowStyle Hidden to avoid detection. A scheduled task created by a non-administrative user that runs such a command hourly is a classic persistence mechanism. This finding warrants immediate investigation of the encoded command and the task's origin.

The combination of Execute, Read, and Write permissions along with the lack of file-backing is a high-confidence indicator of injected code. This configuration allows a process to write a payload to memory and then immediately execute it, which is the standard methodology for process injection attacks.

A root-owned executable in /tmp that is not tracked by the package manager and is parented by cron strongly suggests an attacker added a cron entry to execute a dropped binary. The name mimics a kernel worker to blend in, but kernel threads lack disk executables. The combination of location, ownership, parent, and missing package record makes a malicious interpretation the most defensible.

The LastWrite time of a registry key indicates when the key was last modified. For a newly created service, the LastWrite time of its key in the SYSTEM hive will reflect the creation or last modification time. If this time correlates with the suspected infection window and the service binary is in a user-writable directory, it strongly suggests the service is malicious. Legitimate Windows services typically have older, consistent LastWrite times.

The SAM hive is the repository for local user accounts. It stores account names, group membership, and password hashes. For forensic examiners, this is the primary source for identifying users on the system and potentially cracking passwords to determine the level of access an attacker gained.

Volatile data like memory contents, network connections, and running processes can be lost when a system is powered off. In a ransomware incident, memory may contain encryption keys, command-and-control connections, and other actionable intelligence. Collecting this data first follows the order of volatility and ensures critical evidence is preserved before any shutdown or disk imaging.

The Services registry key stores configuration for each installed service. When a service is created or modified, the LastWrite time of its subkey under CurrentControlSet\Services is updated. This timestamp persists even if the executable is deleted and event logs are cleared, providing a reliable forensic indicator of when the service was installed or last altered. Analysts can correlate this with other artifacts to confirm the installation time.

Resident $DATA attributes store the file content directly within the MFT record, not in separate clusters. A tool that only reads data runs is designed for non-resident attributes and will not extract resident data. Thus, the recovery attempt will fail because the tool does not parse the resident data. The content remains in the MFT record but is inaccessible to this tool.