GCFA Windows Artifact Analysis Practice Question
When analyzing the 'TypedPaths' registry key, what type of user activity is being reviewed?
⚠ Common exam trap
Candidates often confuse TypedPaths with 'RecentDocs' or 'ShellBags', failing to distinguish that TypedPaths specifically records strings entered into the address bar, not just general folder access history.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Windows Explorer navigation paths
The 'TypedPaths' key is a goldmine for investigators as it stores the absolute paths that a user has manually entered into the Windows Explorer address bar. This artifact is highly reliable for proving user intent to access specific directories, including hidden folders or external media paths. By documenting where the user navigated, an analyst can build a compelling case regarding unauthorized file exploration that occurred outside of normal GUI clicking behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run dialog commands
Why it's wrong here
Commands executed via the 'Run' dialog are stored in the 'RunMRU' registry key. TypedPaths is specifically dedicated to folder paths entered into the Windows Explorer address bar. While both are user-typed artifacts, they serve distinct purposes and are located in different registry subkeys within the NTUSER.DAT hive.
- ✓
Windows Explorer navigation paths
Why this is correct
TypedPaths records the history of directory paths the user manually typed into the File Explorer address bar. This provides a direct record of the user's navigational intent, which is particularly useful for identifying access to sensitive directories that are not typically visible through standard menu-based browsing.
- ✗
Recently opened documents
Why it's wrong here
Recently opened documents are tracked in the 'RecentDocs' key within the NTUSER.DAT hive. While TypedPaths might show a user navigating to a folder, it does not store the specific files they opened within that folder, which is the primary function of the RecentDocs MRU lists.
- ✗
External device connection history
Why it's wrong here
External device connection history is stored in the 'USBSTOR' registry key in the SYSTEM hive, which tracks hardware identifiers and installation times. TypedPaths only records user navigation within the file system and does not contain information regarding hardware devices, vendors, or unique serial numbers.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.