GCFA Windows Artifact Analysis Practice Question
Which artifact is the most reliable for determining if an external USB mass storage device was mounted on a system, even if the device is no longer present?
⚠ Common exam trap
Candidates often look at the 'MountPoints2' key instead of 'USBSTOR', failing to realize that MountPoints2 is user-specific and can be cleared, whereas USBSTOR is system-wide and more persistent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
USBSTOR Registry Key
The 'USBSTOR' registry key in the SYSTEM hive is the definitive artifact for tracking USB device history. It records the vendor, model, and unique serial number of every USB device ever connected. This is critical for forensic investigations involving data exfiltration, as it allows the investigator to prove that a specific physical device was present, regardless of whether the user deleted the device drivers or emptied the recycle bin.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Prefetch files
Why it's wrong here
Prefetch files track the execution of applications and their associated loaded modules. While they might occasionally record paths to files located on a USB drive, they do not provide the hardware-level details or history of device mounting that are necessary for identifying a specific USB device connection.
- ✓
USBSTOR Registry Key
Why this is correct
The USBSTOR key in the SYSTEM hive acts as a central repository for all USB device connections. It stores the vendor, product ID, and serial number of the device. Even after the device is disconnected, this entry remains, providing a permanent record of the hardware's interaction with the system.
- ✗
ShellBags
Why it's wrong here
ShellBags track folder navigation and view preferences. While they might show that a folder on an external drive was accessed, they do not record the hardware identifier or serial number of the USB device, making them less reliable than the USBSTOR registry key for hardware-specific attribution.
- ✗
SRUM (System Resource Usage Monitor)
Why it's wrong here
SRUM is excellent for monitoring resource usage over time, but it does not store the specific hardware identifiers for USB devices. It focuses on the data being processed by applications rather than the physical connectivity history of external devices, making it the wrong source for this investigation.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.