Free GIAC GCFE Exam Dumps Questions & Answers

How can 'scheduled tasks' in a user profile indicate malicious activity?

• A.They detail the history of connected Bluetooth devices.
• B.They may include tasks set to run software at specific times, potentially for malicious purposes like data exfiltration or launching attacks.
• C.They provide a log of software uninstallation events.
• D.They track changes in user access levels.

What is the significance of analyzing prefetch files during forensic investigations on Windows systems?

• A.To detect changes in user permissions
• B.To monitor USB device connections
• C.To track network activity
• D.To identify recently executed programs

Which two artifacts are essential for tracking file access and modification times on a Windows system?

• A.Security log
• B.Event Viewer
• C.File metadata
• D.Master File Table (MFT)

What is the importance of the 'Last Access Time' timestamp in the context of forensic investigations? (Choose Two)

• A.It shows the last time a file was accessed, helping to establish a timeline of user activity
• B.It can indicate potential tampering with evidence
• C.It records the last system update
• D.It details changes in file permissions

How does the use of 'write blockers' benefit digital forensic investigations?

• A.They prevent the alteration of data on a storage device during forensic imaging.
• B.They monitor changes to file permissions.
• C.They track the frequency of system backups.
• D.They log user activities in real-time.