Windows Forensics ECSS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why is volatile memory analysis critical in Windows forensics?

   • AIt provides a permanent record of all file system activity
   • BIt captures data that is lost when the system is powered off
   • CIt is required to create a forensic image of the hard drive
   • DIt is the only way to recover deleted files
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During a live incident response, an analyst must capture evidence that would be lost if the system were powered off. Which type of data should be collected first?

   • AThe NTFS $MFT and file system metadata
   • BThe contents of the Recycle Bin
   • CThe contents of RAM, including running processes and network connections
   • DThe Windows event logs
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic analyst is investigating a case of unauthorized software installation. The analyst needs to determine which programs were installed on a Windows 10 system and when. Which registry hive and key should be examined?

   • AHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
   • BHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
   • CHKLM\SYSTEM\CurrentControlSet\Services
   • DHKCU\Software\Microsoft\Windows\CurrentVersion\Run
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic examiner is analyzing a Windows 10 system that has both NTFS and FAT32 partitions. The examiner needs to recover a deleted file from the FAT32 partition. Which challenge is most likely to be encountered?

   • AFAT32 stores files in a single contiguous block, simplifying recovery
   • BFAT32 uses a file allocation table that may be fragmented, complicating recovery
   • CFAT32 does not store file creation timestamps, making timeline analysis difficult
   • DFAT32 does not support unallocated space recovery
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a forensic examination of an NTFS volume, an analyst needs to determine when a specific file was first created on the system. Which timestamp should be examined?

   • AThe Accessed timestamp in the $STANDARD_INFORMATION attribute
   • BThe Modified timestamp in the $FILE_NAME attribute
   • CThe Created (Birth) timestamp in the $STANDARD_INFORMATION attribute
   • DThe Last Written timestamp in the $DATA attribute
   Reveal Solution Discussion Select an answer first