EnCE File Systems & Artifact Examination 3

Question 1

Which Windows Registry hive contains the user's most recently used (MRU) file lists and typed URLs?

Accepted Answer

HKCU\SOFTWARE (NTUSER.DAT)

Answer

NTUSER.DAT maps to HKCU and contains user-specific activity artifacts including MRU lists, typed URLs, and shell bag data.

Question 2

What forensic artifact can be found in Windows Prefetch files (.pf) that is especially valuable to an examiner?

Accepted Answer

List of files and volumes accessed by the executable at run time

Answer

Prefetch files record the executable name, run count, last run timestamps, and the files/directories accessed during the first 10 seconds of execution.

Question 3

An examiner finds a Windows LNK (shortcut) file on a suspect's machine. Which artifact class does this represent?

Accepted Answer

A Shell Link that can reveal the target's original path, volume serial number, and MAC timestamps

Answer

LNK files contain Shell Link Binary File Format data including target path, volume serial number, MAC address of origin machine, and timestamps — even if the target file was deleted.

Question 4

In EnCase, what is the purpose of the 'Recover Folders' feature during an NTFS examination?

Accepted Answer

It reconstructs deleted directory structures from orphaned MFT records

Answer

Recover Folders attempts to rebuild deleted or orphaned directory trees by matching parentage references in unallocated MFT records.

Question 5

Which artifact stored in the Windows Registry at HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR tracks USB storage devices that have been connected to a system?

Accepted Answer

USBSTOR registry key entries

Answer

The USBSTOR key records device class, vendor, product, and serial number for each USB mass storage device ever connected to the system.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE File Systems & Artifact Examination 3