A forensic examiner is responding to an incident on a Windows 10 system. The system is still running, and the examiner needs to capture volatile data, including running processes and network connections. The examiner also needs to preserve the system's memory for later analysis. Which action should be taken first?

Copy the hard drive using a write-blocker

Run network connection commands like netstat

Capture a memory dump using a tool like WinPmem

What is the primary purpose of an alternate data stream (ADS) in NTFS?

To provide a backup copy of the file's data for recovery purposes

To encrypt the file's content to protect it from unauthorized access

To improve file system performance by caching frequently accessed data

To store additional data associated with a file without affecting the file's primary data stream

A forensic examiner is analyzing a FAT32 formatted USB drive and needs to recover a deleted file. The file was deleted recently, and the examiner has a forensic image of the drive. Which technique is most likely to recover the file?

File carving based on file signatures

Parsing the MFT to find the deleted file entry

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 1

Windows Forensics CHFI Practice Questions (Page 10)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

59questions here

12free pages

18concepts

18 Concepts in This Objective

Windows File System Fundamentals
Windows Registry Analysis
Windows Artifact Analysis
Windows Event Log Analysis
Windows Account and Login Forensics
Windows Recycle Bin Forensics
Windows Shortcut (LNK) File Analysis
Windows Volume Shadow Copy Forensics
Windows Memory Forensics Basics
Windows Timeline and Superfetch Analysis
Windows Search and Indexing Forensics
Windows Thumbnail Cache Forensics
Windows Network Forensics
Windows Application and Program Execution Forensics
Windows Deleted File Recovery
Windows Timestamp Analysis
Windows User Activity and Privacy Artifacts
Windows Forensic Tool Usage

Questions 46–50

46expert · hard
A forensic examiner is responding to an incident on a Windows 10 system. The system is still running, and the examiner needs to capture volatile data, including running processes and network connections. The examiner also needs to preserve the system's memory for later analysis. Which action should be taken first?
Select an answer first
47foundation · easy
What is the primary purpose of an alternate data stream (ADS) in NTFS?
Select an answer first
48expert · hard
A forensic examiner is analyzing a FAT32 formatted USB drive and needs to recover a deleted file. The file was deleted recently, and the examiner has a forensic image of the drive. Which technique is most likely to recover the file?
Select an answer first
49application · medium
A forensic examiner is analyzing a Windows 10 system and needs to determine which applications were run on the system, including the last execution time. Which artifact would provide the most comprehensive list of executed applications?
Select an answer first
50foundation · easy
Which Windows Registry hive contains information about the currently logged-on user's settings, including environment variables and desktop configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Windows Forensics CHFI Practice Questions (Page 10)

Questions 46–50

What is the primary purpose of an alternate data stream (ADS) in NTFS?

A forensic examiner is analyzing a FAT32 formatted USB drive and needs to recover a deleted file. The file was deleted recently, and the examiner has a forensic image of the drive. Which technique is most likely to recover the file?

A forensic examiner is analyzing a Windows 10 system and needs to determine which applications were run on the system, including the last execution time. Which artifact would provide the most comprehensive list of executed applications?

Which Windows Registry hive contains information about the currently logged-on user's settings, including environment variables and desktop configuration?

Keep studying — Operating System Forensics