CHFI Windows Operating System Forensics 2

Question 1

Which Windows artifact stores the last 10 commands typed into the Run dialog box and is found in the registry?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Answer

The RunMRU key stores the most recently used commands typed into the Run dialog, useful for tracking attacker activity.

Question 2

A forensic investigator needs to determine which USB devices were ever connected to a Windows system. Which registry key is the primary source?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR

Answer

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR logs all USB storage devices ever connected, including vendor and product IDs.

Question 3

Which Windows log file records successful and failed logon attempts and is critical for investigating unauthorized access?

Accepted Answer

Security.evtx

Answer

Security.evtx contains event IDs 4624 (successful logon) and 4625 (failed logon), making it the primary source for access investigations.

Question 4

What is the purpose of the $MFT file in NTFS forensics?

Accepted Answer

It is the Master File Table containing metadata for every file and directory on the volume

Answer

The $MFT (Master File Table) is the core NTFS structure storing file name, size, timestamps, and data location for every file.

Question 5

A Windows system was shut down abruptly. Which file can help a forensic investigator recover the contents of RAM at the time of shutdown?

Accepted Answer

hiberfil.sys

Answer

hiberfil.sys stores a compressed image of RAM when the system hibernates, allowing recovery of memory contents including running processes and open files.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Windows Operating System Forensics 2