Free GCFE Practice Questions

Question 1

Two USB drives of the same model have been imaged. Each has one FAT32 volume, and neither has been reformatted during the period under investigation. Drive A has hardware serial AX104 and volume serial 31C2-7A90; Drive B has hardware serial BX208 and volume serial 84D1-6B22. Both were assigned E: at different times. A system-generated recent shortcut in an employee's profile targets E:\Plans\pricing.xlsx and records volume serial 84D1-6B22. At acquisition, E: is assigned to Drive A. Which association does the shortcut support?

Accepted Answer

Drive B, because its filesystem volume serial matches the serial retained in the shortcut.

Answer

Drive A, using its current assignment to the E: mount point.

Answer

Drive B, with the shortcut also proving that the spreadsheet was copied onto that drive.

Answer

Neither drive, because the shortcut must contain a hardware serial before its target volume can be identified.

Question 2

During an authorized on-site acquisition, an unlocked Windows 11 laptop displays a critical-battery warning. Its BitLocker volume is accessible, but recovery material is unavailable. Remote access has already been blocked without shutting down the laptop, and no destructive activity is observed. A suitable power supply and validated live-acquisition tools are at hand. What is the immediate evidence-preservation priority?

Accepted Answer

Connect power and preserve the unlocked session for authorized live evidence acquisition.

Answer

Shut down Windows cleanly, then image the encrypted drive through a write blocker.

Answer

Force the laptop off to prevent disk writes, then preserve its drive for offline imaging.

Answer

Begin a full physical image on battery power before connecting equipment that could alter system state.

Question 3

A consistent snapshot of a Chrome profile contains History, History-wal, and History-shm. On working copies, a main-database-only examination finds no visits after 16:20Z. A WAL-aware examination of the same acquisition finds additional valid visit rows in committed transactions after that time. The earlier rows agree, and the acquired files' integrity checks pass. What accounts for the additional visits?

Accepted Answer

The later visits belong to committed transactions in the matching WAL that have not yet been checkpointed into History.

Answer

The WAL reader has interpreted pending, uncommitted transactions as completed visits.

Answer

The extra rows indicate contamination, because committed visits must exist in History itself.

Answer

A checkpoint removed the later visits from History, leaving only deleted fragments in the WAL.

Question 4

A suspicious payment-request email claims to be from an employee at billing@example.org. The recipient's trusted gateway reports SPF fail after forwarding, but DKIM pass with signing domain example.org. The visible From domain is example.org, and its DMARC policy specifies strict alignment and p=reject. The validated DKIM signature covers the From field and message body. Which assessment follows from these results?

Accepted Answer

DMARC passes through aligned DKIM, without establishing that the named employee authored the message.

Answer

DMARC fails because SPF failure takes precedence over a passing DKIM signature.

Answer

The aligned signature proves that the employee authored this payment request.

Answer

Authentication must be deferred until the forwarding server is authorized in the original sender's SPF policy.

Question 5

An NTFS change-journal record documents deletion of bids.xlsx using MFT record number 1420 and sequence number 6. In the acquired $MFT, record 1420 is in use by notes.txt with sequence number 9. Both structures parse correctly. An automated timeline has joined the records using only 1420. How should the apparent relationship be resolved?

Accepted Answer

Separate the records: the changed sequence number identifies reuse of MFT record 1420.

Answer

Treat notes.txt as the renamed bids.xlsx, because a filename change leaves the MFT record number unchanged.

Answer

Treat the names as hard links to one file, because hard links share an MFT record despite different sequence numbers.

Answer

Suspend analysis of both structures, because reuse of an MFT record number makes the filesystem metadata inconsistent.

Question 6

An execution timeline for C:\Tools\pack.exe uses 08:50Z from a Windows 11 AppCompatCache entry as the program's last-run time. The file's NTFS content-modification time is also 08:50Z. A valid Prefetch record for the same executable path contains last-run times of 11:42Z and 10:17Z that day. The timestamps have been normalized to UTC, and no clock changes are identified. Which revision fixes the timeline?

Accepted Answer

Use 11:42Z as the latest recorded execution; the AppCompatCache time reflects file modification.

Answer

Use 10:17Z as the first-ever execution, based on the earlier retained Prefetch timestamp.

Answer

Keep 08:50Z as the last run; the Prefetch times date later reads of the executable.

Answer

Remove execution entries until a user-specific launch artifact identifies the person who ran the program.

Question 7

A user's NTUSER.DAT contains these Explorer search-history entries under Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery:

0 = planned acquisition costs
1 = pricing model
2 = client list
3 = payroll export

MRUListEx bytes:
02 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 FF FF FF FF

Which search term occupies the most-recent position?

Accepted Answer

client list

Answer

pricing model

Answer

planned acquisition costs

Answer

payroll export

Question 8

These Microsoft-Windows-Security-Auditing records come from one host's Security log during the same boot. The three successful logons concern the same account SID.

09:00Z - 4624: New Logon ID 0x210; Logon Type 2
09:03Z - 4624: New Logon ID 0x8B1; Logon Type 10; source 192.0.2.55
09:04Z - 4624: New Logon ID 0x990; Logon Type 3; source 198.51.100.18
09:05Z - 4688: new process C:\Tools\archive.exe; Creator Subject Logon ID 0x8B1; Target Subject Logon ID 0x8B1

Which session provides the recorded security context for archive.exe?

Accepted Answer

The remote interactive session established at 09:03Z, identified by the matching Logon ID.

Answer

The 09:00Z local interactive session, because it was established before the remote logons.

Answer

The 09:04Z network session, because it is closest in time to process creation.

Answer

The three sessions equally, because their common account SID prevents attribution to a particular logon.

Question 9

Chrome records a download of drawings.zip to C:\Users\Dana\Downloads\drawings.zip as COMPLETE at 10:12Z, with received_bytes equal to total_bytes. That path is absent from the acquired filesystem. However, a $I record in Dana's Recycle Bin names the same original path and records deletion at 10:26Z; its matching $R file contains the complete archive, with content verified against the downloaded object. Which proposed statement goes beyond what these artifacts establish?

Accepted Answer

The user opened the downloaded archive before recycling it.

Answer

Chrome recorded completion of the download at 10:12Z.

Answer

The Recycle Bin metadata records deletion of the specified path at 10:26Z.

Answer

The complete archive remained recoverable from the Recycle Bin at acquisition.

Question 10

A preserved Windows endpoint contains a OneDrive for Business item with a blue-cloud icon, a logical size of 24 MiB, and no locally resident content. Local metadata identifies its tenant, account, remote item ID, and version. The requested version remains available through authorized cloud access. The examiner needs the document body while retaining the endpoint's original state. Which acquisition plan meets that need?

Accepted Answer

Preserve the placeholder and its metadata; acquire the matching item and version separately through authorized cloud access.

Answer

Hydrate the item in its original sync folder, then include its body in a new endpoint image.

Answer

Use a physical endpoint image, including unallocated space, as the sole source of the body.

Answer

Postpone cloud collection until a second disk image resolves the missing local content.

Free GCFE Practice Questions

Domain 1: Browser Forensic Artifacts

Question 1

Domain 2: Browser Structure and Analysis

Question 2

Domain 3: Cloud Storage Analysis

Question 3

Domain 4: Digital Forensic Fundamentals

Question 4

Domain 5: Email Analysis

Question 5

Domain 6: Event Log Analysis

Question 6

Domain 7: File and Program Analysis

Question 7

Domain 8: Forensic Artifact Techniques

Question 8

Domain 9: System and Device Analysis

Question 9

Domain 10: User Artifact Analysis

Question 10

That's 10 of 1,030