EnCE File Systems & Artifact Examination 5 — Questions and Answers
Question 1: Which Windows artifact records the last time a user typed a path directly into Windows Explorer's address bar?
- Shellbags
- TypedPaths key in NTUSER.DAT (Correct answer)
- AppCompatCache
- Jump Lists
Correct answer: TypedPaths key in NTUSER.DAT
The TypedPaths registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer stores paths manually typed into the Explorer address bar.
Question 2: What is an Alternate Data Stream (ADS) in NTFS, and why is it forensically significant?
- A redundant copy of MFT records for crash recovery
- An additional named data stream attached to a file that can hide data invisible to standard directory listings (Correct answer)
- A compressed version of a file stored separately
- A backup of file timestamps before modification
Correct answer: An additional named data stream attached to a file that can hide data invisible to standard directory listings
NTFS ADS allows arbitrary data to be stored in a named stream (e.g., file.exe:hidden.dat) that standard tools and Explorer do not display, making it a common data-hiding technique.
Question 3: When a file is 'wiped' using a tool that overwrites file content with zeros, which NTFS artifact may STILL reveal the file existed?
- The $Data attribute
- The $LogFile journal and $UsnJrnl ($J) change journal entries (Correct answer)
- The cluster bitmap
- The volume boot record
Correct answer: The $LogFile journal and $UsnJrnl ($J) change journal entries
$LogFile and the USN Journal ($UsnJrnl:$J) record metadata-level transactions including file creation, rename, and deletion events that persist even after content is overwritten.
Question 4: In EnCase, what does the 'Sweep Enterprise' feature enable that a single-machine examination does not?
- Offline analysis of mobile device images
- Remote simultaneous forensic examination of multiple networked endpoints from a central console (Correct answer)
- Automated malware detonation in a sandbox
- Decryption of BitLocker volumes without a key
Correct answer: Remote simultaneous forensic examination of multiple networked endpoints from a central console
EnCase Enterprise's Sweep allows a single examiner to push agents to many networked machines and conduct concurrent live or dead-box examinations from a central SAFE server.
Question 5: Which SQLite database used by Google Chrome stores browsing history, and what is its typical location on Windows?
- history.db at %APPDATA%\Chrome\
- History at %LOCALAPPDATA%\Google\Chrome\User Data\Default\ (Correct answer)
- chrome_history.sqlite at %PROGRAMFILES%\Google\
- webcache.db at %TEMP%\Chrome\
Correct answer: History at %LOCALAPPDATA%\Google\Chrome\User Data\Default\
Chrome stores browsing history in a SQLite file named 'History' under the Default (or profile) folder within the Chrome User Data directory.
Question 6: What is the 'inode' change time (ctime) in Linux Ext4, and how does it differ from the modification time (mtime)?
- ctime records when file content was last read; mtime records last write
- ctime records when the inode metadata last changed; mtime records when file content was last written (Correct answer)
- ctime and mtime are identical in Ext4
- ctime is set at creation only; mtime is updated on every access
Correct answer: ctime records when the inode metadata last changed; mtime records when file content was last written
In Ext4, mtime reflects the last write to file data content, while ctime reflects the last change to inode metadata (permissions, ownership, link count, etc.).
Question 7: During a live response with EnCase, an examiner uses the 'Volatile' acquisition option. What data does this primarily capture that a traditional disk image would miss?
- Slack space and unallocated clusters
- Running processes, open network connections, and RAM contents (Correct answer)
- File system journal entries
- Encrypted volume headers
Correct answer: Running processes, open network connections, and RAM contents
Volatile data collection captures ephemeral system state — process lists, network connections, and physical memory — that exists only while the system is powered on and is lost on shutdown.
EnCE File Systems & Artifact Examination 5
Which Windows artifact records the last time a user typed a path directly into Windows Explorer's address bar?