CHFI - Computer Hacking Forensic Investigator Windows Operating System Forensics Questions and Answers

Question 1

An investigator is analyzing a Windows 10 system to determine which external storage devices have been previously connected. Which Registry hive and key would provide the most direct evidence of USB devices, including vendor and product IDs?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

The `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR` registry key is specifically designed to enumerate USB Mass Storage Devices that have been connected to the system. It contains subkeys for each unique device, which in turn store details like the device's vendor ID, product ID, and unique serial number.

Question 2

In a Windows forensic investigation, an analyst discovers numerous `.pf` files in the `C:\Windows\Prefetch` directory. What is the primary forensic value of these files?

Accepted Answer

They track application execution, including the execution count and last run time, to speed up future launches.

Answer

Prefetch files (`.pf`) are created by Windows to speed up application loading. Forensically, they are valuable because they record an application's name, an execution count, and up to eight timestamps of the last times the application was run. They also list the files and directories the application accessed upon startup.

Question 3

A forensic investigator suspects that a user has attempted to cover their tracks by clearing the Windows Security Event Log. Which of the following Event IDs would be a direct indicator that this action occurred?

Accepted Answer

1102 (The audit log was cleared)

Answer

Event ID 1102 is specifically generated in the Security log when an administrator or a process with sufficient privileges clears the log. Its presence is a strong indicator of an attempt to hide activity, as it shows the log was intentionally emptied. The other events are standard audit entries for user account activity.

Question 4

An investigator is tasked with determining which files a specific user recently accessed through the Windows taskbar or Start Menu. The user heavily used applications like Microsoft Word and Notepad. Which artifact would be the most efficient to analyze for this information?

Accepted Answer

Jump Lists (.automaticDestinations-ms files)

Answer

Jump Lists are a Windows feature designed to give users quick access to recently opened files and applications directly from the taskbar or Start Menu. These are stored as `.automaticDestinations-ms` and `.customDestinations-ms` files within the user's profile and are an excellent source for determining recent user activity within specific programs.

Question 5

During the analysis of a suspect's Windows user profile, a forensic examiner is trying to reconstruct the user's folder navigation habits, including which folders were opened and what view settings were used (e.g., Details, Icons). Which of the following artifacts specifically stores this type of information?

Accepted Answer

Shellbags

Answer

Shellbags are a set of registry keys that store details about a user's viewing preferences for folders in Windows Explorer, such as window size, position, and view mode. Analyzing Shellbags can reveal which folders a user has accessed, even if those folders no longer exist, providing a history of directory navigation.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Windows Operating System Forensics Questions and Answers