CHFI Windows Operating System Forensics 3

Question 1

Which Windows registry hive is stored in the file %SystemRoot%\System32\config\SAM and what forensic information does it contain?

Accepted Answer

HKLM\SAM — stores local user account names and password hashes

Answer

The SAM hive stores local user accounts and their NTLM/LM password hashes, which can be extracted and cracked offline by investigators or attackers.

Question 2

A forensic examiner finds a file with a .jpg extension but the hex viewer shows the magic bytes 'PK\x03\x04'. What does this indicate?

Accepted Answer

The file extension was deliberately changed to hide that it is a ZIP archive

Answer

Magic bytes 'PK\x03\x04' identify a ZIP archive; a mismatched extension indicates deliberate file masquerading to evade casual inspection.

Question 3

Which tool is built into Windows and can be used to view the detailed security permissions and audit settings on registry keys?

Accepted Answer

regedit.exe with 'Permissions' dialog

Answer

Regedit's right-click Permissions dialog exposes ACLs and audit settings on registry keys, revealing who can read or write each key.

Question 4

What information is stored in the Windows Prefetch files located in C:\Windows\Prefetch?

Accepted Answer

Executable run count, last run time, and files/directories referenced during execution

Answer

Prefetch (.pf) files record execution count, last eight run timestamps, and all files and directories loaded during an application's startup, aiding timeline reconstruction.

Question 5

During a Windows forensic investigation, an examiner identifies event ID 7045 in the System log. What does this event signify?

Accepted Answer

A new service was installed on the system

Answer

Event ID 7045 ('A new service was installed in the system') is a key indicator of malware or attacker persistence via malicious service installation.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Windows Operating System Forensics 3