GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
Which artifact is the primary location for finding 'Shellbag' data, which tracks user folder access history?
⚠ Common exam trap
Candidates often incorrectly guess the SYSTEM hive or SOFTWARE hive, forgetting that Shellbags are user-specific artifacts stored within the individual user's NTUSER.DAT registry file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NTUSER.DAT hive
Shellbags are stored in the NTUSER.DAT registry hive. They provide an invaluable record of which folders a user has opened and the specific view settings applied to those folders. This artifact is critical for forensic investigations because it proves user presence in specific directories, which can be used to link a user account to the staging of malicious files or the browsing of sensitive data during an incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYSTEM hive
Why it's wrong here
The SYSTEM hive contains configuration settings for the Windows OS, such as services, drivers, and startup information. It does not store user-specific browsing history or folder access patterns. Therefore, it is the wrong registry hive to search for evidence of user activity related to specific folder navigation and shell history.
- ✓
NTUSER.DAT hive
Why this is correct
Shellbags are stored in the user-specific NTUSER.DAT registry hive. They track folder access, directory view settings, and navigation history. This registry key is the authoritative source for reconstructing a user's interaction with the file system, providing key evidence of which folders were browsed during the period of interest.
- ✗
SOFTWARE hive
Why it's wrong here
The SOFTWARE hive contains registry keys for installed programs and system-wide application settings. It is not designed to track individual user navigation history or folder access patterns. Shellbag information is user-centric and thus is not stored within this hive, making it useless for reconstructing individual user activity in folders.
- ✗
SAM hive
Why it's wrong here
The SAM hive stores user account information and password hashes. It has no connection to folder navigation or file system history. It is a critical security artifact for identifying local users and groups, but it is entirely unrelated to the forensic task of reconstructing user folder access or shell history.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.