ACE ACE Network & Memory Forensics 2 — Questions and Answers
Question 1: What is the primary forensic value of Windows Event Logs?
- They store a copy of all files created on the system
- They provide a chronological record of system events including logons, service starts, and security actions (Correct answer)
- They contain the full content of deleted files
- They record every keystroke entered by users
Correct answer: They provide a chronological record of system events including logons, service starts, and security actions
Windows Event Logs (Security, System, Application) record timestamped system events that enable forensic reconstruction of activity timelines.
Question 2: Which Windows Security Event ID indicates a successful user account logon?
- Event ID 4625
- Event ID 4624 (Correct answer)
- Event ID 1102
- Event ID 4688
Correct answer: Event ID 4624
Windows Security Event ID 4624 is logged each time a user account successfully authenticates and establishes a logon session.
Question 3: Why is the Windows pagefile (pagefile.sys) forensically significant?
- It contains the user's complete browsing history
- It holds memory pages swapped from RAM to disk, potentially including process data, fragments of documents, and passwords (Correct answer)
- It stores encrypted copies of the SAM database
- It records a log of all file access operations
Correct answer: It holds memory pages swapped from RAM to disk, potentially including process data, fragments of documents, and passwords
The pagefile contains RAM pages that were swapped to disk, preserving volatile data fragments even after the system is shut down.
Question 4: What type of traffic does a packet sniffer capture during network forensic analysis?
- Only HTTPS-encrypted web traffic streams
- Raw network packets traversing the monitored network interface (Correct answer)
- Exclusively DNS query and response messages
- Only wireless beacon and management frames
Correct answer: Raw network packets traversing the monitored network interface
A packet sniffer captures all raw packets at the network interface level, providing complete visibility into communications regardless of protocol.
Question 5: How does FTK analyze web browsing history from a Windows evidence image?
- By running keyword searches on the browser executable only
- By parsing browser artifact databases such as Chrome and Firefox SQLite files and IE index.dat to extract visited URLs and timestamps (Correct answer)
- By reviewing only the browser's LNK shortcut files
- By examining only the Windows Event Log for browser activity
Correct answer: By parsing browser artifact databases such as Chrome and Firefox SQLite files and IE index.dat to extract visited URLs and timestamps
FTK parses browser-specific artifact files (SQLite databases for Chrome/Firefox, index.dat for IE) to reconstruct browsing history with URLs and timestamps.
Question 6: What does Windows Security Event ID 4625 indicate?
- A user account was created
- A failed logon attempt occurred (Correct answer)
- An audit policy was changed
- A privileged service was started
Correct answer: A failed logon attempt occurred
Event ID 4625 is logged whenever an account fails to authenticate, which is critical for detecting brute force attacks and unauthorized access attempts.
ACE ACE Network & Memory Forensics 2
What is the primary forensic value of Windows Event Logs?