Online Access Free GCFE Practice Test

How does examining 'startup folder contents' help in forensic investigations?

• A.It can reveal programs set to automatically start upon login, which might include malware or unauthorized software.
• B.It tracks updates to the graphical user interface.
• C.It provides details on system backup schedules.
• D.It logs changes to power management settings.

What role does the 'SessionStore.js' file play in forensic investigations of a Firefox browser?

• A.It stores data about installed network devices.
• B.It records hardware changes.
• C.It details active logins during the last session.
• D.It provides timestamps of system errors.

How does the use of 'forensic toolkits' aid in the collection of digital evidence? (Choose Two)

• A.They streamline the process of data decryption and password recovery.
• B.They enhance the graphical interface for user ease.
• C.They contain specialized tools for securely acquiring, analyzing, and reporting data.
• D.They automatically update software on the target system.

Which artifact is typically used to determine application execution on Windows?

• A.WebCacheV01.dat
• B.Jump Lists
• C.Prefetch files
• D.SRUM database

Which of the following artifacts from cloud storage services is most valuable in determining when a file was uploaded to the cloud?

• A.Sync logs
• B.Network logs
• C.Prefetch files
• D.Firewall settings