CHFI Windows Operating System Forensics 5 — Questions and Answers
Question 1: Which Windows artifact can reveal evidence of a program execution even if the executable has since been deleted, by tracking compatibility telemetry data?
- Windows Error Reporting (WER) files in C:\ProgramData\Microsoft\Windows\WER
- Application Compatibility Cache (Shimcache) in the registry (Correct answer)
- Windows Installer logs in C:\Windows\Temp
- Driver store at C:\Windows\System32\DriverStore
Correct answer: Application Compatibility Cache (Shimcache) in the registry
The Shimcache (AppCompatCache) registry key tracks executables that the Windows Application Compatibility engine has processed, persisting evidence of execution even after deletion.
Question 2: A CHFI examiner wants to determine the exact time a specific user last logged into a Windows workstation interactively. Which is the most reliable forensic source?
- The user's NTUSER.DAT last-modified timestamp
- Security event log event ID 4624 with Logon Type 2 or 10 (Correct answer)
- HKLM\SAM\SAM\Domains\Account\Users metadata
- The creation date of the user's profile directory
Correct answer: Security event log event ID 4624 with Logon Type 2 or 10
Event ID 4624 with Logon Type 2 (interactive) or Type 10 (remote interactive/RDP) provides the precise timestamp and workstation name for each user logon.
Question 3: What forensic information can be extracted from Windows Jump Lists located in AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations?
- Cached passwords for recently used network shares and web sites
- Recently and frequently accessed files per application, including files on removed media (Correct answer)
- Browser history and cookie data for all installed web browsers
- Scheduled task definitions and their last execution timestamps
Correct answer: Recently and frequently accessed files per application, including files on removed media
Jump Lists store per-application MRU entries (AppIDs) linking recently opened files, revealing what an application accessed even after files are deleted.
Question 4: During a ransomware investigation on a Windows system, which registry artifact would help determine if the Volume Shadow Copies were deleted by the attacker?
- HKLM\SYSTEM\CurrentControlSet\Services\VSS\Parameters
- Security event log event ID 524 for shadow copy deletion
- System event log combined with examining vssadmin.exe in the Shimcache or Amcache (Correct answer)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Correct answer: System event log combined with examining vssadmin.exe in the Shimcache or Amcache
Checking Shimcache/Amcache for vssadmin.exe or wmic.exe execution, combined with System log entries, reveals whether shadow copies were deliberately purged.
Question 5: What is the Amcache.hve file and how does it differ from Shimcache in Windows forensics?
- Amcache is a RAM-based cache while Shimcache is stored on disk; both record network connections
- Amcache is a registry hive storing SHA1 hashes and install/execution metadata; Shimcache stores execution timestamps without hashes (Correct answer)
- Amcache records failed application launches while Shimcache records successful ones
- Amcache stores application settings while Shimcache tracks DLL injection events
Correct answer: Amcache is a registry hive storing SHA1 hashes and install/execution metadata; Shimcache stores execution timestamps without hashes
Amcache.hve stores executable metadata including SHA1 file hash, enabling identification of specific malware binaries, while Shimcache tracks execution without storing hashes.
Question 6: A Windows forensic investigation reveals the presence of a file named 'NTUSER.DAT.LOG1'. What is the forensic significance of this file?
- It is a backup copy of the user hive created by Windows Backup
- It is a transaction log for the NTUSER.DAT registry hive that may contain uncommitted registry changes (Correct answer)
- It records the history of user login timestamps for the past 30 days
- It is an encrypted duplicate of NTUSER.DAT used for BitLocker recovery
Correct answer: It is a transaction log for the NTUSER.DAT registry hive that may contain uncommitted registry changes
NTUSER.DAT.LOG1 and .LOG2 are registry transaction logs that buffer pending writes; they may contain registry data not yet flushed to the main hive file.
Question 7: Which Windows forensic artifact stores evidence of files that were deleted via the Windows GUI (dragged to Recycle Bin) including original file path and deletion time?
- $Recycle.Bin\$I files on the volume root (Correct answer)
- $Recycle.Bin\$R files on the volume root
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
- C:\Windows\System32\recycler.dat
Correct answer: $Recycle.Bin\$I files on the volume root
$I files in $Recycle.Bin store the original file path, file size, and deletion timestamp for each deleted item, while $R files hold the actual deleted content.
