Where are Windows event logs typically stored?

C:\Windows\System32\winevt\Logs

An examiner is investigating a Windows machine where a user allegedly ran a portable application from a USB drive. The application does not appear in the installed programs list. Which registry hive and key should the examiner examine to find evidence of the USB device and the application's execution?

SOFTWARE hive's Uninstall key and the SYSTEM hive's CurrentControlSet\Services key

SYSTEM hive's MountedDevices key and the user's NTUSER.DAT hive's UserAssist key

NTUSER.DAT hive's RecentDocs key and the SOFTWARE hive's Classes\Installer key

SAM hive's Domains\Account\Users key and the SECURITY hive's Policy\PolAdtEv key

Why is memory forensics important in a Windows investigation?

It replaces the need for disk forensics in all investigations.

It is the only way to recover deleted files from the Recycle Bin.

It provides a permanent record of all files ever stored on the hard drive.

It captures data that exists only in RAM, such as running processes, open network connections, and encryption keys.

Which of the following is a user-specific artifact that can reveal a user's web browsing history?

Browser history files (e.g., History, Cookies, Cache)

EC-CouncilDigital Forensics Essentials

Domain 4Objective 2

Windows Memory and Artifact Analysis DFE Practice Questions (Page 6)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

50questions here

10free pages

9concepts

Questions 26–30

26foundation · easy
Where are Windows event logs typically stored?
Select an answer first
27application · medium
An examiner is investigating a Windows machine where a user allegedly ran a portable application from a USB drive. The application does not appear in the installed programs list. Which registry hive and key should the examiner examine to find evidence of the USB device and the application's execution?
Select an answer first
28foundation · easy
Why is memory forensics important in a Windows investigation?
Select an answer first
29foundation · easy
Which of the following is a user-specific artifact that can reveal a user's web browsing history?
Select an answer first
30foundation · easy
Which user activity artifact is created when a user opens a document or file from Windows Explorer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Windows Memory and Artifact Analysis DFE Practice Questions (Page 6)

Questions 26–30

Where are Windows event logs typically stored?

Why is memory forensics important in a Windows investigation?

Which of the following is a user-specific artifact that can reveal a user's web browsing history?

Which user activity artifact is created when a user opens a document or file from Windows Explorer?

Keep studying — Operating System Forensics