Windows Memory and Artifact Analysis DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic examiner is analyzing a Windows 10 system where a user deleted a sensitive PDF file from the Desktop and emptied the Recycle Bin. The examiner needs to recover evidence of the file's existence and possibly its content. Which file system artifact should the examiner examine first?

   • AThe Recycle Bin's $I and $R files
   • BThe pagefile.sys
   • CThe $LogFile journal
   • DThe $MFT entry for the PDF file
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic investigator arrives at a Windows 10 workstation that is suspected of running a credential-stealing process. The machine is currently powered on and the user is logged in. The investigator must preserve the highest-fidelity volatile evidence before any further system interaction. Which action should be taken first?

   • ACreate a forensic image of the hard drive using a write-blocker.
   • BUse a trusted acquisition tool to capture the contents of physical memory to external media.
   • CRun a network capture tool to record all inbound and outbound traffic for later analysis.
   • DCopy the pagefile.sys file from the system drive to an external drive.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic examiner needs to recover a deleted file from a Windows NTFS volume. The file was recently deleted and the system has been powered off. Which file system artifact should be examined first?

   • AThe $MFT (Master File Table)
   • BThe Prefetch folder
   • CThe $LogFile
   • DThe Recycle Bin
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An incident response team is analyzing a Windows server that was compromised. They have a memory dump and a disk image. The team needs to determine the exact sequence of events: when the attacker first connected, what process was used for the attack, and when a backdoor account was created. Which approach would provide the most comprehensive timeline?

   • AOnly use the disk image to extract event logs and registry hives, and ignore the memory dump because it is too volatile.
   • BExtract network connections from the memory dump with Volatility, extract process creation events from the Security event log (Event ID 4688), and extract account creation events from the Security event log (Event ID 4720), then merge all timelines by timestamp.
   • CUse Volatility's timeliner plugin on the memory dump and the Windows event log analyzer on the disk image, but do not merge the results.
   • DOnly use the memory dump to extract processes and network connections, and ignore the disk image because it is less volatile.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is Shimcache (AppCompatCache) used for in Windows forensics?

   • ATo log network packets.
   • BTo manage disk partitions.
   • CTo store user passwords in encrypted form.
   • DTo track program execution and compatibility information.
   Reveal Solution Discussion Select an answer first