GCFA Windows Artifact Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SRUM (System Resource Usage Monitor)

  Why it's wrong here

  SRUM tracks application resource usage over time, including network and CPU usage. While it can show that an application ran, it does not always capture short-lived or command-line executions, and it requires specific configuration. It is not the primary artifact for confirming execution of a specific executable.

• ✗

  Amcache.hve

  Why it's wrong here

  Amcache.hve records metadata about executables that have been run or installed, but it does not definitively prove execution. It can contain entries for files that were merely present or scanned. While useful, it is not as direct a proof of execution as Prefetch, which is created upon execution.

• ✓

  Prefetch files

  Why this is correct

  Prefetch files are created when an executable is run, and they record execution time and run count. If a Prefetch file exists for the malicious executable, it confirms that the program was executed on the system. ShimCache only indicates that the file was present and may have been executed, so Prefetch provides the necessary confirmation.

• ✗

  UserAssist

  Why it's wrong here

  UserAssist records execution of GUI applications launched via Explorer. If the malicious executable was run from the command line or by a service, it may not appear in UserAssist. Therefore, UserAssist is not a reliable indicator for all executions, especially for non-GUI or command-line tools.