EnCE File Systems & Artifact Examination 5

Question 1

Which Windows artifact records the last time a user typed a path directly into Windows Explorer's address bar?

Accepted Answer

TypedPaths key in NTUSER.DAT

Answer

The TypedPaths registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer stores paths manually typed into the Explorer address bar.

Question 2

What is an Alternate Data Stream (ADS) in NTFS, and why is it forensically significant?

Accepted Answer

An additional named data stream attached to a file that can hide data invisible to standard directory listings

Answer

NTFS ADS allows arbitrary data to be stored in a named stream (e.g., file.exe:hidden.dat) that standard tools and Explorer do not display, making it a common data-hiding technique.

Question 3

When a file is 'wiped' using a tool that overwrites file content with zeros, which NTFS artifact may STILL reveal the file existed?

Accepted Answer

The $LogFile journal and $UsnJrnl ($J) change journal entries

Answer

$LogFile and the USN Journal ($UsnJrnl:$J) record metadata-level transactions including file creation, rename, and deletion events that persist even after content is overwritten.

Question 4

In EnCase, what does the 'Sweep Enterprise' feature enable that a single-machine examination does not?

Accepted Answer

Remote simultaneous forensic examination of multiple networked endpoints from a central console

Answer

EnCase Enterprise's Sweep allows a single examiner to push agents to many networked machines and conduct concurrent live or dead-box examinations from a central SAFE server.

Question 5

Which SQLite database used by Google Chrome stores browsing history, and what is its typical location on Windows?

Accepted Answer

History at %LOCALAPPDATA%\Google\Chrome\User Data\Default\

Answer

Chrome stores browsing history in a SQLite file named 'History' under the Default (or profile) folder within the Chrome User Data directory.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE File Systems & Artifact Examination 5