GSEC Windows Forensics — 10 Questions

Question 1

An examiner is investigating file execution history on a Windows 10 system. Which TWO registry keys store information about the most recently executed applications?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist. Registry artifacts are crucial for establishing execution timelines. UserAssist and Shimcache (or AppCompatCache) provide persistent data about what programs ran and when. These artifacts are vital because they remain even if the original executable is deleted, allowing responders to track malicious binaries that might have been removed by an attacker to hide their tracks after executing a secondary payload.

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies

Answer

HKLM\Software\Classes\CLSID

Question 2

Which Windows artifact is most reliable for determining the original file path of a file that was deleted from a USB drive?

Accepted Answer

Shortcut (LNK) files. The Shell Items (LNK files) and Jump Lists often contain metadata about files accessed by the user, including the full original path. Because these files reside on the local system rather than the removable media, they provide a persistent record of activity even after the external device is removed, making them essential for investigators tracking evidence of data exfiltration or access to sensitive files.

Answer

The MFT $LogFile

Answer

Prefetch files

Answer

SAM hive

Question 3

An examiner is analyzing the SYSTEM registry hive. Which THREE pieces of information can be derived from the 'MountedDevices' key?

Accepted Answer

Disk volume serial numbers. The MountedDevices key is fundamental for correlating drive letters with physical volumes. In forensics, this is necessary to link a specific USB device to a user session. By examining the unique identifiers and volume names, an analyst can prove that a specific removable drive was mounted, even if the drive is not present during the actual forensic analysis process.

Answer

USB device vendor ID

Answer

User login timestamps

Question 4

A forensic analyst is examining a Windows 10 workstation and finds a file named '$I0A3B4C5' in the user's Recycle Bin folder alongside '$R0A3B4C5'. The analyst wants to determine the original full path and the time the file was deleted. Which statement correctly describes how these two files support that goal?

Accepted Answer

The $R file contains the original file content and the $I file stores the original path and deletion timestamp in a structured format.. On Windows 10 the Recycle Bin stores deleted items as a pair: the $R file preserves the content under a randomized name, and the companion $I file records metadata such as the original full path and the deletion timestamp. Parsing the $I file with a dedicated tool lets the analyst reconstruct where the file came from and when it was removed, which directly answers the investigative question.

Answer

The $I file contains the original file content and the $R file stores the original path and deletion timestamp in a structured format.

Answer

The $I file is only generated when a file is permanently deleted with Shift+Delete, so its presence proves the file bypassed the Recycle Bin.

Answer

The $R file is the metadata record and the $I file is a linked NTFS alternate data stream attached to the original file.

Question 5

A junior analyst is asked to determine whether a suspicious executable on a Windows 10 workstation was actually run, without relying on live memory. The executable has since been deleted from disk. Which artifact most directly indicates that this specific program executed on the host?

Accepted Answer

The Prefetch file in C:\Windows\Prefetch whose name begins with the executable's name followed by a hash. Prefetch files are created and updated when an executable runs, and they are named after the executable with a hash suffix on current Windows builds. They record run count and last-run timestamps and survive deletion of the binary, making them the most direct artifact for confirming that a specific program executed. Amcache, $MFT, and UserAssist either do not prove execution or do not cover all execution contexts.

Answer

The Amcache.hve Root\InventoryApplicationFile entry for the executable

Answer

The UserAssist key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

The $MFT record showing the executable's data runs

Question 6

An incident responder needs to determine the last time a specific user interacted with a Windows workstation. Which registry hive should be analyzed to retrieve the LastWrite time of the user's NTUSER.DAT file?

Accepted Answer

The user's NTUSER.DAT hive. The NTUSER.DAT file contains user-specific registry settings. Analyzing the LastWrite time of this hive provides insight into when the user profile was last active. In forensics, tracking user activity is critical for establishing a timeline of unauthorized access or insider threats. Examiners must cross-reference this with event logs to confirm if the activity aligns with the suspected malicious incident window.

Answer

SYSTEM hive

Answer

SAM hive

Answer

SOFTWARE hive

Question 7

Refer to the exhibit. An investigator is auditing logon events. Which Event ID indicates a successful network logon (Type 3) to the machine?

Accepted Answer

Event ID 4624 with Logon Type 3. Event ID 4624 records successful logons, and the Logon Type field specifies the method used. A Type 3 logon represents a network connection, often associated with remote file access or service authentication. Identifying these events is essential for detecting lateral movement or unauthorized access via SMB, as attackers frequently use network logons to propagate through a compromised environment using stolen credentials.

Answer

Event ID 4625

Answer

Event ID 4624 with Logon Type 2

Answer

Event ID 4672

Question 8

During a forensic examination, you find a Prefetch file named 'MALWARE.EXE-A1B2C3D4.pf'. What is the significance of the hexadecimal string appended to the filename?

Accepted Answer

It is a hash derived from the file's execution path.. Windows Prefetch files store metadata about application execution to speed up startup times. The hash appended to the filename is calculated based on the path from which the application was executed. This allows investigators to differentiate between multiple instances of the same binary running from different directories, which is a common technique used by attackers to hide malicious binaries in non-standard, obfuscated system locations.

Answer

It is a randomized identifier generated at system boot.

Answer

It represents the hash of the file's content.

Answer

It is the timestamp of the last execution.

Question 9

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Accepted Answer

It maps Security Identifiers (SIDs) to user profile directories.. The ProfileList key maps SIDs to user profile paths. This is critical because an attacker may create a temporary or hidden account. By identifying the exact path to the user profile, the investigator knows where to look for user-specific artifacts like NTUSER.DAT, browser history, and temporary files. This mapping is the starting point for scoping user-level malicious activities and ensuring that no hidden accounts are overlooked during the investigation.

Answer

It defines the system's default language settings.

Answer

It logs every application the user has executed.

Answer

It lists all installed software on the system.

Question 10

When investigating a Windows system, which file system feature is responsible for recording the file metadata including timestamps for created, modified, and accessed (MACE) times?

Accepted Answer

Master File Table (MFT). The Master File Table (MFT) is the core of the NTFS file system. Every file on an NTFS volume has at least one entry in the MFT. These entries contain the MACE times, which are critical for building a timeline of events. If these times are altered, it often indicates anti-forensic activity, making the MFT the primary source for verifying file history and integrity during an investigation.

Answer

Registry hives

Answer

Event Logs

Answer

Prefetch files