MENU
Exhibit:
Where can an analyst find data to provide additional artifacts to support the evidence in the highlighted file?
Suggested Answer: A
Get Premium GASF Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
26 comments · newest first
RA
Raul
1 month ago
I agree with Carolynn. Browsers often hold crucial artifacts.
DY
Dylan
1 month ago
D seems promising too. External sources can add depth to the evidence.
PA
Paulina
2 months ago
I’m leaning towards A. The internal database might have relevant logs.
CA
Carolynn
2 months ago
I think option B is the best choice. Browser data can provide context.
AR
Arlene
2 months ago
I agree with Tammy. Internal sources are usually more trustworthy.
KE
Kenda
2 months ago
D seems risky. External data can be unreliable.
TA
Tammy
2 months ago
I feel like A could be useful too. Internal logs might have relevant info.
LA
Laurel
2 months ago
I think option B is the best choice. Browser data can provide context.
LI
Linn
3 months ago
C) sysmon2.db-shm might provide system monitoring data, but not directly related.
VI
Vilma
3 months ago
D) external.db seems risky. Not always reliable for internal evidence.
AN
Annmarie
3 months ago
I feel A) internal.db-wal could also work. It might have transaction logs.
RI
Rikki
3 months ago
I think B) browser2.db is the best choice. It usually has relevant user activity.
EL
Elvera
3 months ago
Totally agree, A) internal.db-wal is the best option here!
FR
Franchesca
4 months ago
Wait, is D) external.db even reliable for this?
SH
Sharen
5 months ago
C) sysmon2.db-shm might not be relevant, just saying.
BE
Becky
5 months ago
I think B) browser2.db could have useful info too.
EA
Earleen
5 months ago
A) internal.db-wal is a good choice for internal data.
LA
Laine
6 months ago
Wait, are we sure about A)? I thought it was just temporary data.
JI
Jill
6 months ago
D) external.db? That’s a bit vague, not sure about that one.
DE
Derick
6 months ago
C) sysmon2.db-shm might not be useful for this case.
FE
Felicia
6 months ago
I think B) browser2.db could have relevant browsing history.
DO
Dortha
6 months ago
A) internal.db-wal is often used for transaction logs.
SH
Shenika
6 months ago
I’m a bit confused about sysmon2.db-shm; I remember it being related to shared memory, but I’m not sure how that ties into our evidence.
ST
Stephaine
7 months ago
I practiced a question similar to this, and I think external.db could hold useful artifacts too, but I can't recall the specifics.
GE
Gerald
7 months ago
I feel like browser2.db could have relevant browsing history data, which might help support the evidence.
KA
Kati
7 months ago
I think I remember that internal.db-wal might contain transaction logs, but I'm not entirely sure if that's what we're looking for here.