ACE File System & Artifact Analysis Flashcards

What information does the $I file in the Windows Recycle Bin contain?

Answer: Metadata including the original file path, deletion date, and file size

The $I file stores metadata such as the original full path, deletion timestamp, and file size of its corresponding deleted item.

What does the Windows Prefetch directory reveal in a forensic investigation?

Answer: Applications that were executed on the system along with run counts and last run times

Windows Prefetch files record application execution history, including the program name, execution count, and the last time it was run.

What forensic information does a Windows LNK (shortcut) file provide?

Answer: Details about the target file including original path, volume serial number, and timestamps

LNK files record metadata about the target file including its original path, host volume information, and MAC timestamps, revealing user file access history.

What is the purpose of FTK's Known File Filter (KFF)?

Answer: Identify files by known hash values to flag or exclude them, reducing manual review workload

FTK's KFF uses hash libraries such as NSRL to automatically identify known-good or known-bad files, letting examiners focus on unknown or suspicious items.

Which Windows registry key records USB storage device connection history including device serial numbers?

Answer: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

The USBSTOR registry key records each USB storage device that has connected to the system, including unique device serial numbers and connection timestamps.

What does the Windows 'RecentDocs' registry key track?

Answer: Recently accessed files and folders for the logged-in user

The RecentDocs key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs tracks files and folders recently accessed by the user.