A user deleted a confidential document from an NTFS volume and emptied the Recycle Bin. The examiner needs to recover the original file path and the deletion time. Which approach is most likely to yield this information?

Analyze the $I and $R files in the Recycle Bin

Check the NTFS $LogFile for the deletion record

Use Volume Shadow Copies to recover the $I file from a previous system state

Carve the file from unallocated space and analyze the $MFT for the original filename

Which of the following is a common location where LNK files are found on a Windows system?

C:\Users\ \AppData\Roaming\Microsoft\Windows\Recent

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 1

Windows Forensics CHFI Practice Questions (Page 5)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

59questions here

12free pages

18concepts

18 Concepts in This Objective

Windows File System Fundamentals
Windows Registry Analysis
Windows Artifact Analysis
Windows Event Log Analysis
Windows Account and Login Forensics
Windows Recycle Bin Forensics
Windows Shortcut (LNK) File Analysis
Windows Volume Shadow Copy Forensics
Windows Memory Forensics Basics
Windows Timeline and Superfetch Analysis
Windows Search and Indexing Forensics
Windows Thumbnail Cache Forensics
Windows Network Forensics
Windows Application and Program Execution Forensics
Windows Deleted File Recovery
Windows Timestamp Analysis
Windows User Activity and Privacy Artifacts
Windows Forensic Tool Usage

Questions 21–25

21application · medium
A user deleted a confidential document from an NTFS volume and emptied the Recycle Bin. The examiner needs to recover the original file path and the deletion time. Which approach is most likely to yield this information?
Select an answer first
22foundation · easy
Which of the following is a common location where LNK files are found on a Windows system?
Select an answer first
23foundation · easy
Which NTFS timestamp is most likely to change when a file is merely read or opened?
Select an answer first
24foundation · easy
Which Windows artifact is specifically used to optimize application startup and can provide evidence of when an application was last run?
Select an answer first
25foundation · easy
Which component of the NTFS file system is a special file that contains metadata about every file and directory on the volume?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Windows Forensics CHFI Practice Questions (Page 5)

Questions 21–25

A user deleted a confidential document from an NTFS volume and emptied the Recycle Bin. The examiner needs to recover the original file path and the deletion time. Which approach is most likely to yield this information?

Which of the following is a common location where LNK files are found on a Windows system?

Which NTFS timestamp is most likely to change when a file is merely read or opened?

Which Windows artifact is specifically used to optimize application startup and can provide evidence of when an application was last run?

Which component of the NTFS file system is a special file that contains metadata about every file and directory on the volume?

Keep studying — Operating System Forensics