ACE ACE File System & Artifact Analysis 2 — Questions and Answers
Question 1: What information does the $I file in the Windows Recycle Bin contain?
- The original deleted file's full content
- Metadata including the original file path, deletion date, and file size (Correct answer)
- The user account SID that owns the recycle bin
- Browser history entries for the deleted session
Correct answer: Metadata including the original file path, deletion date, and file size
The $I file stores metadata such as the original full path, deletion timestamp, and file size of its corresponding deleted item.
Question 2: What does the Windows Prefetch directory reveal in a forensic investigation?
- Stored user passwords in hashed form
- Applications that were executed on the system along with run counts and last run times (Correct answer)
- Fragments of deleted documents
- Records of incoming network connections
Correct answer: Applications that were executed on the system along with run counts and last run times
Windows Prefetch files record application execution history, including the program name, execution count, and the last time it was run.
Question 3: What forensic information does a Windows LNK (shortcut) file provide?
- The current user's NTLM password hash
- Details about the target file including original path, volume serial number, and timestamps (Correct answer)
- A list of active network connections at creation time
- All installed applications and their install dates
Correct answer: Details about the target file including original path, volume serial number, and timestamps
LNK files record metadata about the target file including its original path, host volume information, and MAC timestamps, revealing user file access history.
Question 4: What is the purpose of FTK's Known File Filter (KFF)?
- Encrypt files marked as sensitive during review
- Identify files by known hash values to flag or exclude them, reducing manual review workload (Correct answer)
- Automatically generate a final case report
- Create forensic images of entire drives
Correct answer: Identify files by known hash values to flag or exclude them, reducing manual review workload
FTK's KFF uses hash libraries such as NSRL to automatically identify known-good or known-bad files, letting examiners focus on unknown or suspicious items.
Question 5: Which Windows registry key records USB storage device connection history including device serial numbers?
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
- HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer
Correct answer: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR registry key records each USB storage device that has connected to the system, including unique device serial numbers and connection timestamps.
Question 6: What does the Windows 'RecentDocs' registry key track?
- Recently installed Windows updates
- Recently accessed files and folders for the logged-in user (Correct answer)
- Recent failed authentication attempts
- Recently connected Bluetooth devices
Correct answer: Recently accessed files and folders for the logged-in user
The RecentDocs key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs tracks files and folders recently accessed by the user.
ACE ACE File System & Artifact Analysis 2
What information does the $I file in the Windows Recycle Bin contain?