SANS FOR500 / GIAC CERTIFIED FORENSIC EXAMINER (GCFE)
COMPLETE 250-QUESTION PRACTICE EXAM AND ANSWERS
QUESTION 1
What is the first step in a digital forensic investigation?
A) Imaging the hard drive
B) Preserving the crime scene
C) Analyzing volatile data
D) Interviewing witnesses
ANSWER: C
Rationale: Volatile data (RAM, running processes, network connections) is lost when the
system is powered off. Collecting volatile data first follows the Order of Volatility principle
in digital forensics.
QUESTION 2
Which tool is most commonly used to create a forensic image of a hard drive?
A) Wireshark
B) FTK Imager
C) RegRipper
D) Volatility
ANSWER: B
Rationale: FTK Imager is a widely used forensic imaging tool that creates bit-for-bit copies
(DD or E01 format) of storage media while preserving integrity with hash verification.
QUESTION 3
,What is the purpose of creating a forensic image hash?
A) To compress the image file
B) To verify the integrity of the image
C) To encrypt the image file
D) To reduce the image size
ANSWER: B
Rationale: Hash values (MD5, SHA-1) are calculated before and after imaging to verify that
the forensic image is an exact, unaltered copy of the original evidence.
QUESTION 4
What does the MFT (Master File Table) contain?
A) The contents of all deleted files
B) Metadata about every file on the volume
C) The Windows registry
D) User account passwords
ANSWER: B
Rationale: The $MFT is a core NTFS file that stores metadata (timestamps, size, attributes,
data runs) for every file and folder on an NTFS volume. It does not store file contents or
passwords.
QUESTION 5
What is the significance of the 𝑀𝐹𝑇STANDARD_INFORMATION attribute?
A) It contains the file's actual data
B) It stores four standard timestamps (MACB)
C) It contains the file's hash
D) It stores the file's encryption key
,ANSWER: B
Rationale: The $STANDARD_INFORMATION attribute contains the four MACB timestamps
(Modified, Accessed, Changed, Birth/Created) for the file. These are used to build forensic
timelines.
QUESTION 6
What is the difference between 𝑆𝑇𝐴𝑁𝐷𝐴𝑅𝐷𝐼 𝑁𝐹𝑂𝑅𝑀𝐴𝑇𝐼𝑂𝑁𝑎𝑛𝑑FILE_NAME timestamps?
A) 𝑆𝑇𝐴𝑁𝐷𝐴𝑅𝐷𝐼 𝑁𝐹𝑂𝑅𝑀𝐴𝑇𝐼𝑂𝑁𝑡𝑖𝑚𝑒𝑠𝑡𝑎𝑚𝑝𝑠𝑐𝑎𝑛𝑏𝑒𝑚𝑜𝑑𝑖𝑓𝑖𝑒𝑑𝑏𝑦𝑢𝑠𝑒𝑟𝑎𝑝𝑝𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛𝑠;FILE_NAM
E timestamps cannot
B) 𝐹𝐼𝐿𝐸𝑁 𝐴𝑀𝐸𝑡𝑖𝑚𝑒𝑠𝑡𝑎𝑚𝑝𝑠𝑐𝑎𝑛𝑏𝑒𝑚𝑜𝑑𝑖𝑓𝑖𝑒𝑑;STANDARD_INFORMATION cannot
C) There is no difference
D) $STANDARD_INFORMATION contains only the creation time
ANSWER: A
Rationale:
𝑆𝑇𝐴𝑁𝐷𝐴𝑅𝐷𝐼 𝑁𝐹𝑂𝑅𝑀𝐴𝑇𝐼𝑂𝑁𝑡𝑖𝑚𝑒𝑠𝑡𝑎𝑚𝑝𝑠𝑎𝑟𝑒𝑒𝑎𝑠𝑖𝑙𝑦𝑚𝑜𝑑𝑖𝑓𝑖𝑒𝑑𝑏𝑦𝑎𝑝𝑝𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛𝑠𝑎𝑛𝑑𝑢𝑠𝑒𝑟𝑎𝑐𝑡𝑖𝑣𝑖𝑡𝑦.
FILE_NAME timestamps are more reliable as they are updated only when the file name is
changed or the file is created, making them harder to tamper with.
QUESTION 7
What is a Volume Shadow Copy (VSS)?
A) A backup of the Windows registry
B) A point-in-time snapshot of the file system
C) A copy of the MFT
D) An encrypted backup of user files
ANSWER: B
, Rationale: Volume Shadow Copy (VSS) is a Windows feature that creates point-in-time
snapshots of files (System Restore points), allowing recovery of previous versions of files
that may have been deleted or modified.
QUESTION 8
Where are Volume Shadow Copies stored?
A) C:\Windows\System32
B) C:\System Volume Information
C) C:\ProgramData
D) C:\Users
ANSWER: B
Rationale: Volume Shadow Copies and System Restore points are stored in the C:\System
Volume Information folder. This folder is protected by the system and not normally
accessible.
QUESTION 9
What is an Alternate Data Stream (ADS)?
A) A way to encrypt files
B) A hidden data stream attached to a file
C) A backup of the MFT
D) A compressed version of a file
ANSWER: B
Rationale: Alternate Data Streams (ADS) are a feature of NTFS that allows additional data
streams to be attached to a file. Malware often uses ADS to hide data. Zone.Identifier is a
common legitimate ADS.
COMPLETE 250-QUESTION PRACTICE EXAM AND ANSWERS
QUESTION 1
What is the first step in a digital forensic investigation?
A) Imaging the hard drive
B) Preserving the crime scene
C) Analyzing volatile data
D) Interviewing witnesses
ANSWER: C
Rationale: Volatile data (RAM, running processes, network connections) is lost when the
system is powered off. Collecting volatile data first follows the Order of Volatility principle
in digital forensics.
QUESTION 2
Which tool is most commonly used to create a forensic image of a hard drive?
A) Wireshark
B) FTK Imager
C) RegRipper
D) Volatility
ANSWER: B
Rationale: FTK Imager is a widely used forensic imaging tool that creates bit-for-bit copies
(DD or E01 format) of storage media while preserving integrity with hash verification.
QUESTION 3
,What is the purpose of creating a forensic image hash?
A) To compress the image file
B) To verify the integrity of the image
C) To encrypt the image file
D) To reduce the image size
ANSWER: B
Rationale: Hash values (MD5, SHA-1) are calculated before and after imaging to verify that
the forensic image is an exact, unaltered copy of the original evidence.
QUESTION 4
What does the MFT (Master File Table) contain?
A) The contents of all deleted files
B) Metadata about every file on the volume
C) The Windows registry
D) User account passwords
ANSWER: B
Rationale: The $MFT is a core NTFS file that stores metadata (timestamps, size, attributes,
data runs) for every file and folder on an NTFS volume. It does not store file contents or
passwords.
QUESTION 5
What is the significance of the 𝑀𝐹𝑇STANDARD_INFORMATION attribute?
A) It contains the file's actual data
B) It stores four standard timestamps (MACB)
C) It contains the file's hash
D) It stores the file's encryption key
,ANSWER: B
Rationale: The $STANDARD_INFORMATION attribute contains the four MACB timestamps
(Modified, Accessed, Changed, Birth/Created) for the file. These are used to build forensic
timelines.
QUESTION 6
What is the difference between 𝑆𝑇𝐴𝑁𝐷𝐴𝑅𝐷𝐼 𝑁𝐹𝑂𝑅𝑀𝐴𝑇𝐼𝑂𝑁𝑎𝑛𝑑FILE_NAME timestamps?
A) 𝑆𝑇𝐴𝑁𝐷𝐴𝑅𝐷𝐼 𝑁𝐹𝑂𝑅𝑀𝐴𝑇𝐼𝑂𝑁𝑡𝑖𝑚𝑒𝑠𝑡𝑎𝑚𝑝𝑠𝑐𝑎𝑛𝑏𝑒𝑚𝑜𝑑𝑖𝑓𝑖𝑒𝑑𝑏𝑦𝑢𝑠𝑒𝑟𝑎𝑝𝑝𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛𝑠;FILE_NAM
E timestamps cannot
B) 𝐹𝐼𝐿𝐸𝑁 𝐴𝑀𝐸𝑡𝑖𝑚𝑒𝑠𝑡𝑎𝑚𝑝𝑠𝑐𝑎𝑛𝑏𝑒𝑚𝑜𝑑𝑖𝑓𝑖𝑒𝑑;STANDARD_INFORMATION cannot
C) There is no difference
D) $STANDARD_INFORMATION contains only the creation time
ANSWER: A
Rationale:
𝑆𝑇𝐴𝑁𝐷𝐴𝑅𝐷𝐼 𝑁𝐹𝑂𝑅𝑀𝐴𝑇𝐼𝑂𝑁𝑡𝑖𝑚𝑒𝑠𝑡𝑎𝑚𝑝𝑠𝑎𝑟𝑒𝑒𝑎𝑠𝑖𝑙𝑦𝑚𝑜𝑑𝑖𝑓𝑖𝑒𝑑𝑏𝑦𝑎𝑝𝑝𝑙𝑖𝑐𝑎𝑡𝑖𝑜𝑛𝑠𝑎𝑛𝑑𝑢𝑠𝑒𝑟𝑎𝑐𝑡𝑖𝑣𝑖𝑡𝑦.
FILE_NAME timestamps are more reliable as they are updated only when the file name is
changed or the file is created, making them harder to tamper with.
QUESTION 7
What is a Volume Shadow Copy (VSS)?
A) A backup of the Windows registry
B) A point-in-time snapshot of the file system
C) A copy of the MFT
D) An encrypted backup of user files
ANSWER: B
, Rationale: Volume Shadow Copy (VSS) is a Windows feature that creates point-in-time
snapshots of files (System Restore points), allowing recovery of previous versions of files
that may have been deleted or modified.
QUESTION 8
Where are Volume Shadow Copies stored?
A) C:\Windows\System32
B) C:\System Volume Information
C) C:\ProgramData
D) C:\Users
ANSWER: B
Rationale: Volume Shadow Copies and System Restore points are stored in the C:\System
Volume Information folder. This folder is protected by the system and not normally
accessible.
QUESTION 9
What is an Alternate Data Stream (ADS)?
A) A way to encrypt files
B) A hidden data stream attached to a file
C) A backup of the MFT
D) A compressed version of a file
ANSWER: B
Rationale: Alternate Data Streams (ADS) are a feature of NTFS that allows additional data
streams to be attached to a file. Malware often uses ADS to hide data. Zone.Identifier is a
common legitimate ADS.
