GIAC Forensics Examiner Practice Test - GCFE Exam Practice Test

A. A plain text file containing user preferences

B. A cache of downloaded images

C. A log file of browser errors

D. A database storing browsing history and bookmarks

A. Logs of user communication via internal messaging systems.

B. Information about user interaction with the operating system's help features.

C. Insights into the data preservation habits of users, including backup practices and potentially hidden or encrypted files.

D. Details on the types of media streamed on the system.

A. It provides insights into the context and sequence of communications between parties.

B. It tracks the installation of third-party email plugins.

C. It logs the network settings used during email exchanges.

D. It shows the frequency of email client updates.

A. Analyze system logs for USB connections

B. Review the registry for USB device information

C. Examine event logs for file transfers

D. Review installed software logs

E. Search for Prefetch files

A. It logs the frequency of hardware upgrades.

B. It helps in determining when specific files were last accessed, which can be crucial in building a timeline of events related to data theft or unauthorized access.

C. It tracks the installation of antivirus software.

D. It provides details on user browsing history.

A. It logs system crashes and failures

B. It stores file system permissions

C. It holds information on partition layout and boot sequence

D. It tracks user login attempts

A. It helps in upgrading system hardware.

B. It can be used to recover data that has been deleted or damaged.

C. It provides a real-time backup of all system activities.

D. It tracks user logins and logouts.

A. By analyzing encrypted files

B. By reviewing the file's access permissions

C. By retrieving logs of failed login attempts

D. By examining unallocated disk space for remnants of deleted files

A. It logs user interactions with cloud services.

B. It shows a list of recently opened documents, which can help establish recent user activities and potential evidence trails.

C. It monitors changes in system security settings.

D. It details the frequency of software updates.

A. It shows the last time a file was accessed, helping to establish a timeline of user activity

B. It details changes in file permissions

C. It can indicate potential tampering with evidence

D. It records the last system update

A. NTUSER.DAT

B. Prefetch files

C. System log

D. Application logs

A. It provides insights into user configurations and installed software, which can be crucial in understanding system usage patterns.

B. It logs user interactions with cloud storage services.

C. It details the frequency of password changes.

D. It tracks the installation of network adapters.