GIAC
GCFE · Question #130
A forensic investigator is analyzing a Windows system suspected of containing malware. The user claims they did not install any suspicious programs. Which artifacts would you analyze to confirm or…
The correct answer is A. Prefetch files B. Master File Table (MFT) E. Application error logs. See the full explanation below for the reasoning.
Question
A forensic investigator is analyzing a Windows system suspected of containing malware. The user claims they did not install any suspicious programs. Which artifacts would you analyze to confirm or refute this claim? (Choose three)
Options
- APrefetch files
- BMaster File Table (MFT)
- CSystem log
- DRecycle Bin contents
- EApplication error logs
How the community answered
(28 responses)- A71% (20)
- C11% (3)
- D18% (5)
Community Discussion
No community discussion yet for this question.