GCFA Windows Artifact Analysis Practice Question
An analyst is investigating a Windows 10 system and finds a suspicious shortcut file in a user's Recent folder. The analyst wants to determine the full path of the target file and any command-line arguments used when the shortcut was created. Which artifact should the analyst examine?
⚠ Common exam trap
The trap here is assuming that jumplists or recent documents registry keys contain the same level of detail as the .lnk file itself, when they often only provide a reference to the file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The .lnk file itself
Shortcut (.lnk) files contain embedded structures that include the target path, working directory, command-line arguments, and other metadata. Parsing these files directly provides the most accurate and detailed information about the shortcut's target, which is essential for understanding what the shortcut would execute.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Windows Registry key: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Why it's wrong here
The RecentDocs registry key tracks recently opened documents by extension, but it does not store the full path or command-line arguments of shortcut files. It provides a list of recent files, not the details of .lnk files. Thus, it would not yield the target path and arguments.
- ✗
The Prefetch file for explorer.exe
Why it's wrong here
Prefetch files for explorer.exe indicate that the file explorer was executed, but they do not contain information about specific shortcut files or their targets. They are not suitable for extracting the target path and arguments from a .lnk file. Therefore, this is incorrect.
- ✗
The jumplist AutomaticDestinations file
Why it's wrong here
Jumplist AutomaticDestinations files store information about recent files and tasks for applications, but they do not contain the full path and arguments of shortcut files. They may reference the shortcut, but the detailed target information is in the .lnk file itself. Therefore, this is not the best source for the specific details.
- ✓
The .lnk file itself
Why this is correct
The .lnk file (shortcut) contains a LinkTargetIDList and other structures that store the original target path, as well as command-line arguments if present. By parsing the .lnk file, the analyst can extract the full path and any arguments, making it the correct artifact for this purpose.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.