GCFE 試験問題を無料オンラインアクセス

What role does the Master File Table (MFT) play in the forensic analysis of NTFS filesystems?

• A.It tracks changes to firewall settings.
• B.It contains metadata for each file and directory.
• C.It logs user login attempts and times.
• D.It details software installation processes.

What type of forensic data can be extracted from a browser's cache?

• A.Network logon times
• B.Recent system errors
• C.Webpage content and resources
• D.Encryption key usage

Which Windows artifact stores details about USB devices that were plugged into a system?

• A.Registry key: SYSTEM\CurrentControlSet\Enum\USBSTOR
• B.$MFT
• C.Prefetch
• D.Shimcache

Which cloud storage artifact is crucial for identifying the origin of accessed files during an investigation? (Choose Two)

• A.Configuration files
• B.Metadata files
• C.Sync logs
• D.User profile databases

Which two user artifacts are critical for understanding a user's browsing habits?

• A.NTUSER.DAT
• B.System logs
• C.Cache files
• D.Cookies.sqlite