EnCE File Systems & Artifact Examination 3 — Questions and Answers
Question 1: Which Windows Registry hive contains the user's most recently used (MRU) file lists and typed URLs?
- HKLM\SYSTEM
- HKCU\SOFTWARE (NTUSER.DAT) (Correct answer)
- HKLM\SAM
- HKLM\SECURITY
Correct answer: HKCU\SOFTWARE (NTUSER.DAT)
NTUSER.DAT maps to HKCU and contains user-specific activity artifacts including MRU lists, typed URLs, and shell bag data.
Question 2: What forensic artifact can be found in Windows Prefetch files (.pf) that is especially valuable to an examiner?
- Full memory dump at application launch
- List of files and volumes accessed by the executable at run time (Correct answer)
- Network connections made by the process
- Encryption keys used by the application
Correct answer: List of files and volumes accessed by the executable at run time
Prefetch files record the executable name, run count, last run timestamps, and the files/directories accessed during the first 10 seconds of execution.
Question 3: An examiner finds a Windows LNK (shortcut) file on a suspect's machine. Which artifact class does this represent?
- A file that proves the target file was executed
- A Shell Link that can reveal the target's original path, volume serial number, and MAC timestamps (Correct answer)
- An encrypted container for file transfer
- A prefetch entry for a deleted executable
Correct answer: A Shell Link that can reveal the target's original path, volume serial number, and MAC timestamps
LNK files contain Shell Link Binary File Format data including target path, volume serial number, MAC address of origin machine, and timestamps — even if the target file was deleted.
Question 4: In EnCase, what is the purpose of the 'Recover Folders' feature during an NTFS examination?
- It decrypts BitLocker-protected folders
- It reconstructs deleted directory structures from orphaned MFT records (Correct answer)
- It restores permissions on locked files
- It reindexes the MFT after corruption
Correct answer: It reconstructs deleted directory structures from orphaned MFT records
Recover Folders attempts to rebuild deleted or orphaned directory trees by matching parentage references in unallocated MFT records.
Question 5: Which artifact stored in the Windows Registry at HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR tracks USB storage devices that have been connected to a system?
- SetupAPI logs
- USBSTOR registry key entries (Correct answer)
- Prefetch files
- Event ID 4663 entries
Correct answer: USBSTOR registry key entries
The USBSTOR key records device class, vendor, product, and serial number for each USB mass storage device ever connected to the system.
Question 6: What does the Windows $Recycle.Bin artifact '$I' file contain that the '$R' file does not?
- The actual file content
- The original file path, deletion timestamp, and original file size (Correct answer)
- The file's SACL permissions
- The recycle bin's index checksum
Correct answer: The original file path, deletion timestamp, and original file size
$I files are metadata records storing the original path, size, and deletion date, while $R files contain the actual deleted file content.
Question 7: Which tool built into EnCase enables keyword search across allocated and unallocated space simultaneously?
- File Finder
- EnScript
- Keyword Search (with Search Unallocated Space option) (Correct answer)
- Condition Filter
Correct answer: Keyword Search (with Search Unallocated Space option)
EnCase's Keyword Search can be configured to sweep both allocated file content and raw unallocated clusters in a single pass.
EnCE File Systems & Artifact Examination 3
Which Windows Registry hive contains the user's most recently used (MRU) file lists and typed URLs?