A forensic examiner is analyzing an NTFS volume and needs to recover a deleted file that was stored in an alternate data stream (ADS). The examiner has identified the MFT entry for the file, but the ADS data is not visible in the normal file listing. Which approach should the examiner take to recover the ADS data?

Use file carving on the unallocated space

Use the command prompt to type 'dir /r' to list ADS

Use the Windows Search index to find the ADS

Use a forensic tool that can parse NTFS ADS and extract the data from the MFT entry

A forensic examiner is responding to a live incident on a Windows 10 system. The examiner needs to capture volatile data that would be lost when the system is powered off. Which data should be captured FIRST?

The contents of RAM (memory dump)

The contents of the hard drive (disk image)

A forensic analyst is investigating a Windows 10 system that was used to access a malicious website. The analyst needs to determine the IP address that the system resolved for the domain name. Which artifact should the analyst examine?

The DNS cache in the registry (HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces)

The DNS client cache (ipconfig /displaydns)

EC-CouncilComputer Hacking Forensic Investigator

Domain 3Objective 1

Windows Forensics CHFI Practice Questions (Page 6)

Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.

59questions here

12free pages

18concepts

18 Concepts in This Objective

Windows File System Fundamentals
Windows Registry Analysis
Windows Artifact Analysis
Windows Event Log Analysis
Windows Account and Login Forensics
Windows Recycle Bin Forensics
Windows Shortcut (LNK) File Analysis
Windows Volume Shadow Copy Forensics
Windows Memory Forensics Basics
Windows Timeline and Superfetch Analysis
Windows Search and Indexing Forensics
Windows Thumbnail Cache Forensics
Windows Network Forensics
Windows Application and Program Execution Forensics
Windows Deleted File Recovery
Windows Timestamp Analysis
Windows User Activity and Privacy Artifacts
Windows Forensic Tool Usage

Questions 26–30

26expert · hard
A forensic examiner is analyzing an NTFS volume and needs to recover a deleted file that was stored in an alternate data stream (ADS). The examiner has identified the MFT entry for the file, but the ADS data is not visible in the normal file listing. Which approach should the examiner take to recover the ADS data?
Select an answer first
27expert · hard
A forensic examiner is responding to a live incident on a Windows 10 system. The examiner needs to capture volatile data that would be lost when the system is powered off. Which data should be captured FIRST?
Select an answer first
28foundation · easy
Which registry hive contains the Security Account Manager (SAM) database that stores local user account credentials?
Select an answer first
29application · medium
A forensic analyst is investigating a Windows 10 system that was used to access a malicious website. The analyst needs to determine the IP address that the system resolved for the domain name. Which artifact should the analyst examine?
Select an answer first
30foundation · easy
Which Windows artifact records the execution of programs from the GUI and is stored in the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Windows Forensics CHFI Practice Questions (Page 6)

Questions 26–30

A forensic examiner is responding to a live incident on a Windows 10 system. The examiner needs to capture volatile data that would be lost when the system is powered off. Which data should be captured FIRST?

Which registry hive contains the Security Account Manager (SAM) database that stores local user account credentials?

A forensic analyst is investigating a Windows 10 system that was used to access a malicious website. The analyst needs to determine the IP address that the system resolved for the domain name. Which artifact should the analyst examine?

Which Windows artifact records the execution of programs from the GUI and is stored in the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist?

Keep studying — Operating System Forensics