A forensic examiner is investigating a case where a user allegedly viewed images on a Windows 10 system. The original images were deleted, but the examiner wants to find evidence of the images being viewed. Which artifact would be most useful?

The thumbnail cache files (thumbcache_*.db)

A forensic examiner is investigating a case involving illicit images on a Windows 10 system. The images were deleted, but the examiner wants to recover thumbnails that may have been generated when the images were viewed. Which file should the examiner look for?

The $LogFile in the NTFS volume

The Windows.edb file in the ProgramData folder

The iconcache_*.db files in the same folder

thumbcache_*.db files in the user's AppData\Local\Microsoft\Windows\Explorer folder

Where are the Recycle Bin files ($I and $R) stored on a Windows system?

In the root of each drive under the $Recycle.Bin folder

In the C:\Windows\System32 folder

In the C:\Users\Public\Recycle Bin folder

In the user's profile under AppData\Local

What is the primary forensic value of thumbnail cache files (thumbcache_*.db) on a Windows system?

They contain a list of all user passwords

They store the full content of all files on the system

They contain image previews that can reveal what images were viewed on the system

They record all network connections made by the system

A forensic analyst is investigating a case where a user allegedly accessed a sensitive document on a network share. The analyst found a .lnk file in the user's Recent Items folder. What information from the LNK file would help confirm the document was accessed?

The icon location and the window state

The network share name and the local drive letter

The target path and the MAC times of the LNK file

The file size and the volume serial number

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 1

Windows Forensics CHFI Practice Questions (Page 4)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

59questions here

12free pages

18concepts

18 Concepts in This Objective

Windows File System Fundamentals
Windows Registry Analysis
Windows Artifact Analysis
Windows Event Log Analysis
Windows Account and Login Forensics
Windows Recycle Bin Forensics
Windows Shortcut (LNK) File Analysis
Windows Volume Shadow Copy Forensics
Windows Memory Forensics Basics
Windows Timeline and Superfetch Analysis
Windows Search and Indexing Forensics
Windows Thumbnail Cache Forensics
Windows Network Forensics
Windows Application and Program Execution Forensics
Windows Deleted File Recovery
Windows Timestamp Analysis
Windows User Activity and Privacy Artifacts
Windows Forensic Tool Usage

Questions 16–20

16application · medium
A forensic examiner is investigating a case where a user allegedly viewed images on a Windows 10 system. The original images were deleted, but the examiner wants to find evidence of the images being viewed. Which artifact would be most useful?
Select an answer first
17application · medium
A forensic examiner is investigating a case involving illicit images on a Windows 10 system. The images were deleted, but the examiner wants to recover thumbnails that may have been generated when the images were viewed. Which file should the examiner look for?
Select an answer first
18foundation · easy
Where are the Recycle Bin files ($I and $R) stored on a Windows system?
Select an answer first
19foundation · easy
What is the primary forensic value of thumbnail cache files (thumbcache_*.db) on a Windows system?
Select an answer first
20application · medium
A forensic analyst is investigating a case where a user allegedly accessed a sensitive document on a network share. The analyst found a .lnk file in the user's Recent Items folder. What information from the LNK file would help confirm the document was accessed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.