CHFI Windows Operating System Forensics 2 — Questions and Answers
Question 1: Which Windows artifact stores the last 10 commands typed into the Run dialog box and is found in the registry?
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU (Correct answer)
- HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
- HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Correct answer: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
The RunMRU key stores the most recently used commands typed into the Run dialog, useful for tracking attacker activity.
Question 2: A forensic investigator needs to determine which USB devices were ever connected to a Windows system. Which registry key is the primary source?
- HKLM\SYSTEM\CurrentControlSet\Enum\USB
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
- HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR (Correct answer)
Correct answer: HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR
HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR logs all USB storage devices ever connected, including vendor and product IDs.
Question 3: Which Windows log file records successful and failed logon attempts and is critical for investigating unauthorized access?
- System.evtx
- Application.evtx
- Security.evtx (Correct answer)
- Setup.evtx
Correct answer: Security.evtx
Security.evtx contains event IDs 4624 (successful logon) and 4625 (failed logon), making it the primary source for access investigations.
Question 4: What is the purpose of the $MFT file in NTFS forensics?
- It stores encrypted file system keys
- It is the Master File Table containing metadata for every file and directory on the volume (Correct answer)
- It logs all file access timestamps in real time
- It contains the Windows boot sector and partition layout
Correct answer: It is the Master File Table containing metadata for every file and directory on the volume
The $MFT (Master File Table) is the core NTFS structure storing file name, size, timestamps, and data location for every file.
Question 5: A Windows system was shut down abruptly. Which file can help a forensic investigator recover the contents of RAM at the time of shutdown?
- hiberfil.sys (Correct answer)
- pagefile.sys
- swapfile.sys
- bootmgr
Correct answer: hiberfil.sys
hiberfil.sys stores a compressed image of RAM when the system hibernates, allowing recovery of memory contents including running processes and open files.
Question 6: Which Windows artifact records the applications that were set to auto-start at system boot and can reveal persistence mechanisms used by malware?
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Correct answer)
- HKLM\SYSTEM\CurrentControlSet\Control\CrashControl
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Correct answer: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
The Run key under both HKLM and HKCU is a common persistence location where programs are registered to execute automatically at every user login.
Question 7: In Windows forensics, what does the acronym LNK file refer to and why is it forensically significant?
- A linked database file used by SQL Server to store transaction logs
- A Windows shortcut file that records metadata about accessed files including original path and timestamps (Correct answer)
- A network configuration file storing linked DNS resolver entries
- A locked file handle record created when a file is opened exclusively
Correct answer: A Windows shortcut file that records metadata about accessed files including original path and timestamps
LNK (shortcut) files automatically created in Recent Items contain metadata about accessed files including MAC times, file size, and original volume serial number.
CHFI Windows Operating System Forensics 2
Which Windows artifact stores the last 10 commands typed into the Run dialog box and is found in the registry?