CHFI Windows Operating System Forensics 4 — Questions and Answers
Question 1: A CHFI investigator is analyzing a Windows system and wants to identify all network connections that were active at the time of a memory dump. Which command-line tool output should be examined in the memory image?
- ipconfig /all
- netstat -ano (Correct answer)
- arp -a
- route print
Correct answer: netstat -ano
Netstat -ano output captured in memory shows all active TCP/UDP connections, their PIDs, and listening ports at the exact time of acquisition.
Question 2: Which Windows artifact contains evidence of files that were recently printed, including document name, printer used, and timestamp?
- C:\Windows\System32\spool\PRINTERS\ (Correct answer)
- HKCU\Printers\DevModePerUser
- C:\ProgramData\Microsoft\Windows\WER\
- HKLM\SYSTEM\CurrentControlSet\Control\Print\Printers
Correct answer: C:\Windows\System32\spool\PRINTERS\
The Windows print spooler folder stores EMF and SHD spool files for print jobs, including document metadata and timing, until the job completes.
Question 3: In NTFS, which metadata file records changes to the file system including file creation, modification, and deletion, and is essential for timeline analysis?
- $Bitmap
- $LogFile
- $UsnJrnl:$J (Correct answer)
- $Boot
Correct answer: $UsnJrnl:$J
The NTFS Change Journal ($UsnJrnl:$J) records file system changes with USN (Update Sequence Number) entries, enabling chronological reconstruction of file activity.
Question 4: What does Windows event ID 4688 record and why is it forensically valuable?
- A user account password was changed
- A new process was created, including the process name and parent process (Correct answer)
- A file was deleted from the Recycle Bin
- A shared network resource was accessed remotely
Correct answer: A new process was created, including the process name and parent process
Event ID 4688 logs process creation events with executable path and parent PID, enabling investigators to reconstruct attacker command execution chains.
Question 5: An investigator recovers a Windows system where the attacker cleared the Security event log. Which artifact may still contain evidence of the log clearing action?
- The Application event log — event ID 1102
- The System event log — event ID 104 (Correct answer)
- Both the System log (1074) and Application log (1000)
- The Setup event log — event ID 2
Correct answer: The System event log — event ID 104
Event ID 104 in the System log records when the Security log was cleared, and event ID 1102 in the Security log records the same action if any entries remain.
Question 6: Which Windows registry key stores the time zone setting of the system, which is critical for accurate timeline normalization during forensic analysis?
- HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation (Correct answer)
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones
- HKCU\Control Panel\International\TimeZone
- HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
Correct answer: HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
The TimeZoneInformation key stores the active time zone bias values used by Windows, essential for converting system timestamps to UTC for accurate correlation.
Question 7: A forensic investigator discovers shellbags in the Windows registry. What specific user activity do shellbags record?
- Files downloaded from the internet through web browsers
- Folder view preferences and evidence that a user opened specific folders, including on removed external drives (Correct answer)
- Application installation history including install date and version
- Shell command history from PowerShell and CMD sessions
Correct answer: Folder view preferences and evidence that a user opened specific folders, including on removed external drives
Shellbags store folder view settings and prove a user opened specific directories, even revealing folder names from devices no longer connected to the system.
CHFI Windows Operating System Forensics 4
A CHFI investigator is analyzing a Windows system and wants to identify all network connections that were active at the time of a memory dump.
Which command-line tool output should be examined in the memory image?