GIAC Certified Forensic Analyst (GCFA) Exam Guide

1. Introduction to memory forensics: understand how and when to collect volatile data from a system and how to document and preserve the integrity of volatile evidence
2. Analyzing volatile Windows event artifacts: understand normal activity within the structure of Windows memory and identify artifacts such as network connections, memory resident command line artifacts and processes, handles and threads
3. Analyzing volatile malicious event artifacts: understand abnormal activity within the structure of Windows memory and identify artifacts such as malicious processes, suspicious drivers and malware techniques such as code injection and rootkits

Example scenario: A memory image shows svchost.exe running from a user's temp folder with an unusual parent process. What would you examine next?

1. Introduction to file system timeline forensics: understand the methodology required to collect and process timeline data from a Windows system
2. File system timeline artifact analysis: understand the Windows filesystem time structure and how these artifacts are modified by system and user activity
3. NTFS artifact analysis: understand core structures of the Windows filesystems, and identify, recover, and analyze evidence from any file system layer, including the data storage layer, metadata layer, and filename layer

Example scenario: A suspicious file's creation time is years earlier than the operating system install date. Which artifacts would help you decide whether it was timestomped?

1. Windows artifact analysis: understand Windows system artifacts and how to collect and analyze data such as system back up and restore data and evidence of application execution
2. Identification of normal system and user activity: understand the techniques required to identify, document, and differentiate normal and abnormal system and user activity using memory and disk resident artifacts
3. Identification of malicious system and user activity: understand the techniques required to identify and document indicators of compromise on a system, detect malware and attacker tools, attribute activity to events and accounts, and identify and compensate for anti-forensic actions using memory and disk resident artifacts

Example scenario: An administrator account ran a remote management tool on 30 hosts at 2 a.m. Which execution artifacts would confirm what ran on each host?

1. Enterprise environment incident response: understand the steps of the incident response process, attack progression, and adversary fundamentals and how to rapidly assess and analyze systems in an enterprise environment scaling tools to meet the demands of large investigations

Example scenario: Threat intelligence names a malware family seen in your sector. How would you sweep 2,000 endpoints for its indicators without imaging each one?