CHFI - Computer Hacking Forensic Investigator Windows Operating System Forensics Questions and Answers

Question 1

An investigator is analyzing a Windows 10 system to determine which external storage devices have been previously connected.
Which Registry hive and key would provide the most direct evidence of USB devices, including vendor and product IDs?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

HKEY_LOCAL_MACHINE\SAM\Domains\Account\Users

Answer

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\TypedURLs

Question 2

In a Windows forensic investigation, an analyst discovers numerous `.pf` files in the `C:\Windows\Prefetch` directory. What is the primary forensic value of these files?

Accepted Answer

They track application execution, including the execution count and last run time, to speed up future launches.

Answer

They store user-specific application settings and configurations in a binary format.

Answer

They provide a detailed, real-time log of all files accessed by the operating system kernel.

Answer

They cache portions of web pages and scripts for faster browsing in Microsoft Edge.

Question 3

A forensic investigator suspects that a user has attempted to cover their tracks by clearing the Windows Security Event Log. Which of the following Event IDs would be a direct indicator that this action occurred?

Accepted Answer

1102 (The audit log was cleared)

Answer

4624 (An account was successfully logged on)

Answer

4720 (A user account was created)

Answer

4634 (An account was logged off)

Question 4

An investigator is tasked with determining which files a specific user recently accessed through the Windows taskbar or Start Menu. The user heavily used applications like Microsoft Word and Notepad. Which artifact would be the most efficient to analyze for this information?

Accepted Answer

Jump Lists (.automaticDestinations-ms files)

Answer

The NTUSER.DAT registry hive's MRU lists

Answer

Volume Shadow Copies (VSS)

Answer

The hiberfil.sys file

Question 5

During the analysis of a suspect's Windows user profile, a forensic examiner is trying to reconstruct the user's folder navigation habits, including which folders were opened and what view settings were used (e.g., Details, Icons). Which of the following artifacts specifically stores this type of information?

Accepted Answer

Shellbags

Answer

Prefetch files

Answer

Shimcache (Amcache.hve)

Answer

The Security Account Manager (SAM) hive

Question 6

A forensic analyst acquires the `hiberfil.sys` file from a Windows 10 laptop. What type of information can the analyst expect to recover by analyzing this file?

Accepted Answer

A compressed copy of the system's RAM at the time of the last hibernation.

Answer

A historical log of all installed programs and their version numbers.

Answer

A backup of the Master File Table (MFT) and critical registry hives.

Answer

Encrypted user login credentials for all accounts on the system.