CHFI - Computer Hacking Forensic Investigator Windows Operating System Forensics Questions and Answers — Questions and Answers
Question 1: An investigator is analyzing a Windows 10 system to determine which external storage devices have been previously connected. Which Registry hive and key would provide the most direct evidence of USB devices, including vendor and product IDs?
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
- HKEY_LOCAL_MACHINE\SAM\Domains\Account\Users
- HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs
Correct answer: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
The `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR` registry key is specifically designed to enumerate USB Mass Storage Devices that have been connected to the system. It contains subkeys for each unique device, which in turn store details like the device's vendor ID, product ID, and unique serial number.
Question 2: In a Windows forensic investigation, an analyst discovers numerous `.pf` files in the `C:\Windows\Prefetch` directory. What is the primary forensic value of these files?
- They store user-specific application settings and configurations in a binary format.
- They provide a detailed, real-time log of all files accessed by the operating system kernel.
- They track application execution, including the execution count and last run time, to speed up future launches. (Correct answer)
- They cache portions of web pages and scripts for faster browsing in Microsoft Edge.
Correct answer: They track application execution, including the execution count and last run time, to speed up future launches.
Prefetch files (`.pf`) are created by Windows to speed up application loading. Forensically, they are valuable because they record an application's name, an execution count, and up to eight timestamps of the last times the application was run. They also list the files and directories the application accessed upon startup.
Question 3: A forensic investigator suspects that a user has attempted to cover their tracks by clearing the Windows Security Event Log. Which of the following Event IDs would be a direct indicator that this action occurred?
- 4624 (An account was successfully logged on)
- 4720 (A user account was created)
- 1102 (The audit log was cleared) (Correct answer)
- 4634 (An account was logged off)
Correct answer: 1102 (The audit log was cleared)
Event ID 1102 is specifically generated in the Security log when an administrator or a process with sufficient privileges clears the log. Its presence is a strong indicator of an attempt to hide activity, as it shows the log was intentionally emptied. The other events are standard audit entries for user account activity.
Question 4: An investigator is tasked with determining which files a specific user recently accessed through the Windows taskbar or Start Menu. The user heavily used applications like Microsoft Word and Notepad. Which artifact would be the most efficient to analyze for this information?
- The NTUSER.DAT registry hive's MRU lists
- Volume Shadow Copies (VSS)
- Jump Lists (.automaticDestinations-ms files) (Correct answer)
- The hiberfil.sys file
Correct answer: Jump Lists (.automaticDestinations-ms files)
Jump Lists are a Windows feature designed to give users quick access to recently opened files and applications directly from the taskbar or Start Menu. These are stored as `.automaticDestinations-ms` and `.customDestinations-ms` files within the user's profile and are an excellent source for determining recent user activity within specific programs.
Question 5: During the analysis of a suspect's Windows user profile, a forensic examiner is trying to reconstruct the user's folder navigation habits, including which folders were opened and what view settings were used (e.g., Details, Icons). Which of the following artifacts specifically stores this type of information?
- Prefetch files
- Shimcache (Amcache.hve)
- The Security Account Manager (SAM) hive
- Shellbags (Correct answer)
Correct answer: Shellbags
Shellbags are a set of registry keys that store details about a user's viewing preferences for folders in Windows Explorer, such as window size, position, and view mode. Analyzing Shellbags can reveal which folders a user has accessed, even if those folders no longer exist, providing a history of directory navigation.
Question 6: A forensic analyst acquires the `hiberfil.sys` file from a Windows 10 laptop. What type of information can the analyst expect to recover by analyzing this file?
- A historical log of all installed programs and their version numbers.
- A compressed copy of the system's RAM at the time of the last hibernation. (Correct answer)
- A backup of the Master File Table (MFT) and critical registry hives.
- Encrypted user login credentials for all accounts on the system.
Correct answer: A compressed copy of the system's RAM at the time of the last hibernation.
The `hiberfil.sys` file is used by Windows for the hibernation power-saving state. It contains a compressed snapshot of the contents of physical RAM at the moment the system was hibernated. This makes it an incredibly valuable source for memory forensics if a live acquisition was not possible, as it can contain running processes, network connections, loaded DLLs, and other volatile data.
CHFI - Computer Hacking Forensic Investigator Windows Operating System Forensics Questions and Answers
An investigator is analyzing a Windows 10 system to determine which external storage devices have been previously connected.
Which Registry hive and key would provide the most direct evidence of USB devices, including vendor and product IDs?