CHFI Windows Operating System Forensics 4

Question 1

A CHFI investigator is analyzing a Windows system and wants to identify all network connections that were active at the time of a memory dump. Which command-line tool output should be examined in the memory image?

Accepted Answer

netstat -ano

Answer

Netstat -ano output captured in memory shows all active TCP/UDP connections, their PIDs, and listening ports at the exact time of acquisition.

Question 2

Which Windows artifact contains evidence of files that were recently printed, including document name, printer used, and timestamp?

Accepted Answer

C:\Windows\System32\spool\PRINTERS\

Answer

The Windows print spooler folder stores EMF and SHD spool files for print jobs, including document metadata and timing, until the job completes.

Question 3

In NTFS, which metadata file records changes to the file system including file creation, modification, and deletion, and is essential for timeline analysis?

Accepted Answer

$UsnJrnl:$J

Answer

The NTFS Change Journal ($UsnJrnl:$J) records file system changes with USN (Update Sequence Number) entries, enabling chronological reconstruction of file activity.

Question 4

What does Windows event ID 4688 record and why is it forensically valuable?

Accepted Answer

A new process was created, including the process name and parent process

Answer

Event ID 4688 logs process creation events with executable path and parent PID, enabling investigators to reconstruct attacker command execution chains.

Question 5

An investigator recovers a Windows system where the attacker cleared the Security event log. Which artifact may still contain evidence of the log clearing action?

Accepted Answer

The System event log — event ID 104

Answer

Event ID 104 in the System log records when the Security log was cleared, and event ID 1102 in the Security log records the same action if any entries remain.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Windows Operating System Forensics 4