CHFI Windows Operating System Forensics 5

Question 1

Which Windows artifact can reveal evidence of a program execution even if the executable has since been deleted, by tracking compatibility telemetry data?

Accepted Answer

Application Compatibility Cache (Shimcache) in the registry

Answer

The Shimcache (AppCompatCache) registry key tracks executables that the Windows Application Compatibility engine has processed, persisting evidence of execution even after deletion.

Question 2

A CHFI examiner wants to determine the exact time a specific user last logged into a Windows workstation interactively. Which is the most reliable forensic source?

Accepted Answer

Security event log event ID 4624 with Logon Type 2 or 10

Answer

Event ID 4624 with Logon Type 2 (interactive) or Type 10 (remote interactive/RDP) provides the precise timestamp and workstation name for each user logon.

Question 3

What forensic information can be extracted from Windows Jump Lists located in AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations?

Accepted Answer

Recently and frequently accessed files per application, including files on removed media

Answer

Jump Lists store per-application MRU entries (AppIDs) linking recently opened files, revealing what an application accessed even after files are deleted.

Question 4

During a ransomware investigation on a Windows system, which registry artifact would help determine if the Volume Shadow Copies were deleted by the attacker?

Accepted Answer

System event log combined with examining vssadmin.exe in the Shimcache or Amcache

Answer

Checking Shimcache/Amcache for vssadmin.exe or wmic.exe execution, combined with System log entries, reveals whether shadow copies were deliberately purged.

Question 5

What is the Amcache.hve file and how does it differ from Shimcache in Windows forensics?

Accepted Answer

Amcache is a registry hive storing SHA1 hashes and install/execution metadata; Shimcache stores execution timestamps without hashes

Answer

Amcache.hve stores executable metadata including SHA1 file hash, enabling identification of specific malware binaries, while Shimcache tracks execution without storing hashes.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Windows Operating System Forensics 5