EC-CouncilComputer Hacking Forensic Investigator
Domain 3Objective 1
Windows Forensics CHFI Practice Questions (Page 7)
Part of the Operating System Forensics domain, which makes up ~12% of our current practice bank.
59questions here
12free pages
18concepts
Questions 31–35
- 31
In which folder are thumbnail cache files typically located on a Windows system?
Select an answer first - 32
In the Windows Registry, what is the term for the top-level organizational units that contain keys, subkeys, and values?
Select an answer first - 33
Which of the following artifacts is most likely to contain evidence of a user's web browsing activity?
Select an answer first - 34
A forensic examiner is analyzing an NTFS volume and needs to recover a deleted file. The examiner has identified the file's MFT entry, but the file's data runs have been overwritten. The examiner also has a Volume Shadow Copy from a time before the file was deleted. Which method is most likely to recover the file's content?
Select an answer first - 35
What is the name of the database file that stores the Windows Search index?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.