A forensic examiner is reconstructing a timeline of user activity on a Windows 10 system. The examiner has found Prefetch files, Shimcache, and UserAssist entries. Which artifact would provide the most reliable chronological order of program executions?

Prefetch files, because they contain the last execution time

Combine all three artifacts to correlate execution times

UserAssist, because it records the last execution time and run count

Shimcache, because it records the last execution time for each program

What is the purpose of constructing a timeline in Windows forensics?

To correlate events and artifacts in chronological order to reconstruct system activity

To encrypt forensic evidence for secure storage

To compress forensic data to save storage space

To automatically delete irrelevant files from the system

An examiner is investigating a Windows system that was used to connect to a malicious server. The examiner wants to identify the IP address of the server from the system's network activity. Which artifact should be examined first?

The TCP/IP connection history in the registry

A forensic examiner is analyzing a Windows 10 system to determine whether a user viewed a specific image file that has since been deleted. Which artifact is most likely to contain a preview of the image?

The thumbcache_*.db files in the user's AppData folder

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 1

Windows Forensics CHFI Practice Questions (Page 3)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

59questions here

12free pages

18concepts

18 Concepts in This Objective

Windows File System Fundamentals
Windows Registry Analysis
Windows Artifact Analysis
Windows Event Log Analysis
Windows Account and Login Forensics
Windows Recycle Bin Forensics
Windows Shortcut (LNK) File Analysis
Windows Volume Shadow Copy Forensics
Windows Memory Forensics Basics
Windows Timeline and Superfetch Analysis
Windows Search and Indexing Forensics
Windows Thumbnail Cache Forensics
Windows Network Forensics
Windows Application and Program Execution Forensics
Windows Deleted File Recovery
Windows Timestamp Analysis
Windows User Activity and Privacy Artifacts
Windows Forensic Tool Usage

Questions 11–15

11application · medium
A forensic examiner is reconstructing a timeline of user activity on a Windows 10 system. The examiner has found Prefetch files, Shimcache, and UserAssist entries. Which artifact would provide the most reliable chronological order of program executions?
Select an answer first
12foundation · easy
What is the purpose of constructing a timeline in Windows forensics?
Select an answer first
13foundation · easy
In NTFS, what does the 'M' in MAC times stand for?
Select an answer first
14application · medium
An examiner is investigating a Windows system that was used to connect to a malicious server. The examiner wants to identify the IP address of the server from the system's network activity. Which artifact should be examined first?
Select an answer first
15application · medium
A forensic examiner is analyzing a Windows 10 system to determine whether a user viewed a specific image file that has since been deleted. Which artifact is most likely to contain a preview of the image?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.