During an investigation, an examiner finds a .lnk file on a user's desktop that points to a document on a network share. The examiner wants to determine when the document was last accessed and the name of the machine that hosted the share. Which information can be extracted from the LNK file?

The target file's creation, modification, and access times, along with the network share's UNC path

The MAC times of the target file and the volume serial number of the local drive

The file's MD5 hash and the share's security descriptor

The local machine's hostname and the user's SID

A forensic examiner needs to acquire a forensic image of a Windows 10 system's hard drive. The system is running and the examiner wants to minimize changes to the system. Which acquisition method is most appropriate?

Perform a live acquisition using a tool like FTK Imager

Use the built-in backup utility to create a system image

Copy the entire drive using Windows Explorer

Perform a static acquisition by booting from a forensic live CD

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 1

Windows Forensics CHFI Practice Questions (Page 12)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

59questions here

12free pages

18concepts

18 Concepts in This Objective

Windows File System Fundamentals
Windows Registry Analysis
Windows Artifact Analysis
Windows Event Log Analysis
Windows Account and Login Forensics
Windows Recycle Bin Forensics
Windows Shortcut (LNK) File Analysis
Windows Volume Shadow Copy Forensics
Windows Memory Forensics Basics
Windows Timeline and Superfetch Analysis
Windows Search and Indexing Forensics
Windows Thumbnail Cache Forensics
Windows Network Forensics
Windows Application and Program Execution Forensics
Windows Deleted File Recovery
Windows Timestamp Analysis
Windows User Activity and Privacy Artifacts
Windows Forensic Tool Usage

Questions 56–59

56application · medium
During an investigation, an examiner finds a .lnk file on a user's desktop that points to a document on a network share. The examiner wants to determine when the document was last accessed and the name of the machine that hosted the share. Which information can be extracted from the LNK file?
Select an answer first
57application · medium
An examiner is analyzing a Windows 10 system to determine which user accounts were used to log on and whether any accounts were recently created. Which registry hives should be examined to obtain this information?
Select an answer first
58foundation · easy
Which Windows artifact is a registry key that tracks the execution of programs and is also known as the Application Compatibility Cache?
Select an answer first
59application · medium
A forensic examiner needs to acquire a forensic image of a Windows 10 system's hard drive. The system is running and the examiner wants to minimize changes to the system. Which acquisition method is most appropriate?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Windows Forensics CHFI Practice Questions (Page 12)

Questions 56–59

During an investigation, an examiner finds a .lnk file on a user's desktop that points to a document on a network share. The examiner wants to determine when the document was last accessed and the name of the machine that hosted the share. Which information can be extracted from the LNK file?

An examiner is analyzing a Windows 10 system to determine which user accounts were used to log on and whether any accounts were recently created. Which registry hives should be examined to obtain this information?

Which Windows artifact is a registry key that tracks the execution of programs and is also known as the Application Compatibility Cache?

A forensic examiner needs to acquire a forensic image of a Windows 10 system's hard drive. The system is running and the examiner wants to minimize changes to the system. Which acquisition method is most appropriate?

Keep studying — Operating System Forensics