CHFI Windows Operating System Forensics 3 — Questions and Answers
Question 1: Which Windows registry hive is stored in the file %SystemRoot%\System32\config\SAM and what forensic information does it contain?
- HKLM\SECURITY — stores local security policies and cached credentials
- HKLM\SAM — stores local user account names and password hashes (Correct answer)
- HKCU — stores the current user's personal preferences and recent documents
- HKLM\SOFTWARE — stores installed application settings and license keys
Correct answer: HKLM\SAM — stores local user account names and password hashes
The SAM hive stores local user accounts and their NTLM/LM password hashes, which can be extracted and cracked offline by investigators or attackers.
Question 2: A forensic examiner finds a file with a .jpg extension but the hex viewer shows the magic bytes 'PK\x03\x04'. What does this indicate?
- The file is a corrupted JPEG and cannot be recovered
- The file extension was deliberately changed to hide that it is a ZIP archive (Correct answer)
- The JPEG was compressed with PK encryption before storage
- The file is a Windows Portable Key certificate, not an image
Correct answer: The file extension was deliberately changed to hide that it is a ZIP archive
Magic bytes 'PK\x03\x04' identify a ZIP archive; a mismatched extension indicates deliberate file masquerading to evade casual inspection.
Question 3: Which tool is built into Windows and can be used to view the detailed security permissions and audit settings on registry keys?
- regedit.exe with 'Permissions' dialog (Correct answer)
- msconfig.exe
- eventvwr.msc
- gpedit.msc
Correct answer: regedit.exe with 'Permissions' dialog
Regedit's right-click Permissions dialog exposes ACLs and audit settings on registry keys, revealing who can read or write each key.
Question 4: What information is stored in the Windows Prefetch files located in C:\Windows\Prefetch?
- Cached DNS query results used to speed up network connections
- Executable run count, last run time, and files/directories referenced during execution (Correct answer)
- Pre-fetched web page content stored by Internet Explorer
- Application crash dumps collected before system shutdown
Correct answer: Executable run count, last run time, and files/directories referenced during execution
Prefetch (.pf) files record execution count, last eight run timestamps, and all files and directories loaded during an application's startup, aiding timeline reconstruction.
Question 5: During a Windows forensic investigation, an examiner identifies event ID 7045 in the System log. What does this event signify?
- A user account was locked out after repeated failed logon attempts
- A new service was installed on the system (Correct answer)
- A removable disk was safely removed from the system
- Windows Defender detected and quarantined malware
Correct answer: A new service was installed on the system
Event ID 7045 ('A new service was installed in the system') is a key indicator of malware or attacker persistence via malicious service installation.
Question 6: Which Windows artifact tracks files and folders that a user has recently accessed via Windows Explorer and can be found in the user profile?
- C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\ (Correct answer)
- C:\Users\<user>\AppData\Local\Microsoft\Windows\History\
- C:\ProgramData\Microsoft\Windows\Recent Documents\
- C:\Windows\System32\Recent\
Correct answer: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\
The Recent folder in the user's AppData contains LNK shortcut files pointing to recently accessed files and folders, automatically maintained by the shell.
Question 7: What is the forensic significance of the Windows Volume Shadow Copy Service (VSS)?
- It encrypts files at rest to prevent unauthorized access during forensic acquisition
- It creates point-in-time snapshots of volumes that may contain previous versions of deleted or modified files (Correct answer)
- It monitors network traffic and logs packet captures to a shadow volume
- It maintains a duplicate copy of the MFT in a hidden shadow partition
Correct answer: It creates point-in-time snapshots of volumes that may contain previous versions of deleted or modified files
VSS shadow copies can contain previous versions of files, registry hives, and even deleted artifacts, providing investigators access to historical system states.
CHFI Windows Operating System Forensics 3
Which Windows registry hive is stored in the file %SystemRoot%\System32\config\SAM and what forensic information does it contain?