20+ practice questions focused on OS and Network Forensics — one of the most tested topics on the Computer Hacking Forensic Investigator CHFI exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start OS and Network Forensics PracticeA forensic analyst recovers a USB device from a suspect's computer. Which Windows registry key should be examined to determine the first time the USB device was connected?
Explanation: The USBSTOR key under Enum in the SYSTEM hive stores detailed history of USB mass storage devices, including the first connection timestamp via the 'Properties' subkey (e.g., {83da6326-97a6-4088-9453-a1923f573b29} for first install date). This is the definitive location for determining the initial insertion time of a USB device in Windows forensics.
In Windows forensics, which artifact is used to track recently accessed files and folders via the 'Recent Items' feature?
Explanation: D is correct because LNK files (shortcut files) are the primary artifacts created by the Windows 'Recent Items' feature. When a user accesses a file or folder via the GUI (e.g., double-clicking), Windows automatically generates a corresponding .lnk file in the user's `%APPDATA%\Microsoft\Windows\Recent` directory, recording the target path, volume serial number, and timestamps. This makes LNK files the direct forensic evidence of recently accessed items through the Recent Items list.
Which of the following Windows registry keys is commonly used by malware to achieve persistence by executing a program at user logon?
Explanation: The HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is specifically designed to launch programs automatically when the current user logs on. Malware commonly writes a value pointing to its executable under this key to achieve user-level persistence without requiring administrative privileges, as it runs in the context of the logged-on user.
Which TWO Linux log files are MOST relevant for investigating authentication events and user login activity? (Choose TWO.)
Explanation: Option D, /var/log/auth.log, is correct because on Debian-based Linux systems it is the dedicated log where the PAM subsystem and sshd record authentication events such as successful and failed logins, sudo usage, and su attempts. Option E, /var/log/syslog, is correct because it is the general system log that captures authentication and login-related messages forwarded by rsyslog (including authpriv entries on many distributions), making it a key source for correlating user login activity. The other options do not belong: /var/log/boot.log (A) only records messages from the system boot process, /var/log/dmesg (B) contains kernel ring buffer output about hardware and driver initialization, and /var/log/kern.log (C) holds kernel-level messages, none of which specifically document authentication or user login events.
During a Windows forensic investigation, an analyst finds a registry key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. What type of artifact is this, and what information does it typically contain?
Explanation: The UserAssist key under NTUSER.DAT tracks GUI-based program launches via the Windows Explorer shell. It stores a Rot13-encoded or base64-encoded binary blob containing the executable path, a count of executions, and the last execution timestamp in a FILETIME format. This makes it a primary artifact for identifying user application usage history.
+15 more OS and Network Forensics questions available
Practice all OS and Network Forensics questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of OS and Network Forensics. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
OS and Network Forensics questions on the CHFI frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. OS and Network Forensics is tested as part of the Computer Hacking Forensic Investigator CHFI blueprint. Practicing with targeted OS and Network Forensics questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CHFI practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but OS and Network Forensics is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full OS and Network Forensics practice session with instant scoring and detailed explanations.
Start OS and Network Forensics Practice →