Windows Memory and Artifact Analysis DFE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A forensic examiner is called to a Windows 10 machine that is suspected of running ransomware. The machine is on and the user is logged in. The examiner needs to acquire memory and also preserve the ability to correlate the memory dump with disk artifacts. The examiner has limited time and must choose the best order of actions. Which order is most appropriate?

   • AAcquire memory and image the disk simultaneously using a hardware write blocker.
   • BImage the disk first, then acquire memory, then shut down the system.
   • CShut down the system first, then acquire memory from the hibernation file, then image the disk.
   • DAcquire memory first, then image the disk, then shut down the system.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An examiner is investigating a Windows 10 system and needs to determine which executables were run from a temporary folder on a specific date. The system has prefetch enabled. Which artifact would provide the most direct evidence of these executions?

   • AShimcache in the SYSTEM hive
   • BPrefetch files in C:\Windows\Prefetch
   • CEvent log Security ID 4688
   • DThe $MFT entry for the executable
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst has a memory dump from a compromised Windows server. The analyst suspects a specific process injected code into another process and made network connections to an external IP. Which Volatility command sequence would most directly confirm both the injection and the network connection?

   • ARun 'timeliner' to generate a timeline, then 'shimcache' to list application compatibility entries, and 'svcscan' to list services.
   • BRun 'pslist' to list processes, then 'malfind' to detect injected code, and 'netscan' to list network connections.
   • CRun 'pstree' to show parent-child relationships, then 'dlllist' to list loaded DLLs, and 'iehistory' to show browser history.
   • DRun 'hashdump' to extract password hashes, then 'lsadump' to get credentials, and 'envars' to list environment variables.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is investigating a Windows 10 system where a user is suspected of running a specific portable tool that is not installed. The analyst has the disk image and needs to prove the tool was executed, even though the user may have deleted the executable. Which combination of registry and file system artifacts would provide the strongest evidence?

   • AUninstall keys in the SOFTWARE hive and the $MFT entry for the tool
   • BUserAssist keys in NTUSER.DAT and Shimcache in the SYSTEM hive
   • CEvent logs Security ID 4688 and the System event log
   • DMountedDevices in the SYSTEM hive and RecentDocs in NTUSER.DAT
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic examiner is investigating a case where a user deleted a sensitive file from a Windows NTFS volume. The system has been powered off since the deletion. The examiner needs to recover the file content. Which approach is most likely to succeed?

   • ACheck the Recycle Bin for the file.
   • BExamine the Prefetch folder for the file's execution.
   • CUse the $LogFile to reconstruct the file content.
   • DAnalyze the $MFT to locate the file's data runs and attempt to recover the data from the unallocated space.
   Reveal Solution Discussion Select an answer first