Online Access Free GCFE Exam Questions

For forensic investigations, what crucial information does the analysis of M365 email logs provide?

• A.Data about file access requests
• B.Information on hardware configurations used
• C.User interface customizations
• D.Details on email transactions and user activities

What is the role of browser session restore files in forensic investigations?

• A.They track changes to system hardware.
• B.They log error reports.
• C.They show open tabs and windows at the time of closure.
• D.They indicate software installation.

What is the primary purpose of Windows event logs in the context of digital forensics?

• A.To provide a detailed record of system, application, and security events
• B.To monitor network connection speeds and stability
• C.To record user interface customizations
• D.To list all installed applications and their usage statistics

Why is the 'Last Known Good Configuration' data important in forensic analysis of Windows systems?

• A.It contains information about the last system state that booted successfully without errors, which can help identify changes that led to system issues.
• B.It monitors the installation of software updates.
• C.It logs details of deleted files.
• D.It provides data on network connectivity issues.

What is the significance of 'shadow copies' in Windows in a forensic investigation?

• A.They monitor the installation of device drivers.
• B.They are automatic backups of files and folders that can provide earlier versions of data, useful for understanding the state of files before changes were made.
• C.They log user activity in real-time chat applications.
• D.They provide a continuous record of system error messages.