GSEC Windows Forensics — All Questions With Answers

Question 1

An examiner is investigating file execution history on a Windows 10 system. Which TWO registry keys store information about the most recently executed applications?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist. Registry artifacts are crucial for establishing execution timelines. UserAssist and Shimcache (or AppCompatCache) provide persistent data about what programs ran and when. These artifacts are vital because they remain even if the original executable is deleted, allowing responders to track malicious binaries that might have been removed by an attacker to hide their tracks after executing a secondary payload.

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies

Answer

HKLM\Software\Classes\CLSID

Question 2

Which Windows artifact is most reliable for determining the original file path of a file that was deleted from a USB drive?

Accepted Answer

Shortcut (LNK) files. The Shell Items (LNK files) and Jump Lists often contain metadata about files accessed by the user, including the full original path. Because these files reside on the local system rather than the removable media, they provide a persistent record of activity even after the external device is removed, making them essential for investigators tracking evidence of data exfiltration or access to sensitive files.

Answer

The MFT $LogFile

Answer

Prefetch files

Answer

SAM hive

Question 3

An examiner is analyzing the SYSTEM registry hive. Which THREE pieces of information can be derived from the 'MountedDevices' key?

Accepted Answer

Disk volume serial numbers. The MountedDevices key is fundamental for correlating drive letters with physical volumes. In forensics, this is necessary to link a specific USB device to a user session. By examining the unique identifiers and volume names, an analyst can prove that a specific removable drive was mounted, even if the drive is not present during the actual forensic analysis process.

Answer

USB device vendor ID

Answer

User login timestamps

Question 4

A forensic analyst is examining a Windows 10 workstation and finds a file named '$I0A3B4C5' in the user's Recycle Bin folder alongside '$R0A3B4C5'. The analyst wants to determine the original full path and the time the file was deleted. Which statement correctly describes how these two files support that goal?

Accepted Answer

The $R file contains the original file content and the $I file stores the original path and deletion timestamp in a structured format.. On Windows 10 the Recycle Bin stores deleted items as a pair: the $R file preserves the content under a randomized name, and the companion $I file records metadata such as the original full path and the deletion timestamp. Parsing the $I file with a dedicated tool lets the analyst reconstruct where the file came from and when it was removed, which directly answers the investigative question.

Answer

The $I file contains the original file content and the $R file stores the original path and deletion timestamp in a structured format.

Answer

The $I file is only generated when a file is permanently deleted with Shift+Delete, so its presence proves the file bypassed the Recycle Bin.

Answer

The $R file is the metadata record and the $I file is a linked NTFS alternate data stream attached to the original file.

Question 5

A junior analyst is asked to determine whether a suspicious executable on a Windows 10 workstation was actually run, without relying on live memory. The executable has since been deleted from disk. Which artifact most directly indicates that this specific program executed on the host?

Accepted Answer

The Prefetch file in C:\Windows\Prefetch whose name begins with the executable's name followed by a hash. Prefetch files are created and updated when an executable runs, and they are named after the executable with a hash suffix on current Windows builds. They record run count and last-run timestamps and survive deletion of the binary, making them the most direct artifact for confirming that a specific program executed. Amcache, $MFT, and UserAssist either do not prove execution or do not cover all execution contexts.

Answer

The Amcache.hve Root\InventoryApplicationFile entry for the executable

Answer

The UserAssist key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

The $MFT record showing the executable's data runs

Question 6

An incident responder needs to determine the last time a specific user interacted with a Windows workstation. Which registry hive should be analyzed to retrieve the LastWrite time of the user's NTUSER.DAT file?

Accepted Answer

The user's NTUSER.DAT hive. The NTUSER.DAT file contains user-specific registry settings. Analyzing the LastWrite time of this hive provides insight into when the user profile was last active. In forensics, tracking user activity is critical for establishing a timeline of unauthorized access or insider threats. Examiners must cross-reference this with event logs to confirm if the activity aligns with the suspected malicious incident window.

Answer

SYSTEM hive

Answer

SAM hive

Answer

SOFTWARE hive

Question 7

Refer to the exhibit. An investigator is auditing logon events. Which Event ID indicates a successful network logon (Type 3) to the machine?

Accepted Answer

Event ID 4624 with Logon Type 3. Event ID 4624 records successful logons, and the Logon Type field specifies the method used. A Type 3 logon represents a network connection, often associated with remote file access or service authentication. Identifying these events is essential for detecting lateral movement or unauthorized access via SMB, as attackers frequently use network logons to propagate through a compromised environment using stolen credentials.

Answer

Event ID 4625

Answer

Event ID 4624 with Logon Type 2

Answer

Event ID 4672

Question 8

During a forensic examination, you find a Prefetch file named 'MALWARE.EXE-A1B2C3D4.pf'. What is the significance of the hexadecimal string appended to the filename?

Accepted Answer

It is a hash derived from the file's execution path.. Windows Prefetch files store metadata about application execution to speed up startup times. The hash appended to the filename is calculated based on the path from which the application was executed. This allows investigators to differentiate between multiple instances of the same binary running from different directories, which is a common technique used by attackers to hide malicious binaries in non-standard, obfuscated system locations.

Answer

It is a randomized identifier generated at system boot.

Answer

It represents the hash of the file's content.

Answer

It is the timestamp of the last execution.

Question 9

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Accepted Answer

It maps Security Identifiers (SIDs) to user profile directories.. The ProfileList key maps SIDs to user profile paths. This is critical because an attacker may create a temporary or hidden account. By identifying the exact path to the user profile, the investigator knows where to look for user-specific artifacts like NTUSER.DAT, browser history, and temporary files. This mapping is the starting point for scoping user-level malicious activities and ensuring that no hidden accounts are overlooked during the investigation.

Answer

It defines the system's default language settings.

Answer

It logs every application the user has executed.

Answer

It lists all installed software on the system.

Question 10

When investigating a Windows system, which file system feature is responsible for recording the file metadata including timestamps for created, modified, and accessed (MACE) times?

Accepted Answer

Master File Table (MFT). The Master File Table (MFT) is the core of the NTFS file system. Every file on an NTFS volume has at least one entry in the MFT. These entries contain the MACE times, which are critical for building a timeline of events. If these times are altered, it often indicates anti-forensic activity, making the MFT the primary source for verifying file history and integrity during an investigation.

Answer

Registry hives

Answer

Event Logs

Answer

Prefetch files

Question 11

An incident responder is analyzing a Windows 10 workstation that is suspected of being used to exfiltrate data. The responder runs 'wevtutil qe Security /q:"*[System[(EventID=5156)]]" /f:text' but finds no events. Which action will most reliably produce the network connection telemetry the responder needs for this investigation?

Accepted Answer

Enable the 'Audit Filtering Platform Connection' policy under Advanced Audit Policy Configuration and ensure the Security log is large enough to retain events.. Event ID 5156 is generated only when the Filtering Platform Connection audit subcategory is enabled through Advanced Audit Policy Configuration; the default configuration does not log these events, which explains the empty query result. Enabling the subcategory and providing adequate log capacity gives the responder the process, user, and endpoint details required to trace the suspected exfiltration activity on the workstation.

Answer

Set the Security log retention method to 'Overwrite events as needed' and increase the maximum log size to 1 GB.

Answer

Run 'netsh trace start capture=yes' and review the resulting ETL file in Event Viewer under the Microsoft-Windows-TCPIP operational log.

Answer

Enable the 'Audit Process Creation' policy and configure the 'Include command line in process creation events' setting to capture outbound connections.

Question 12

An incident responder collects volatile data from a compromised Windows 10 workstation before pulling the power. The attacker used a custom executable that is no longer present on disk, but the responder needs to confirm which process spawned it and what child processes it created. Which artifact should the responder examine to establish this parent-child process relationship?

Accepted Answer

The Sysmon Event ID 1 records in the Microsoft-Windows-Sysmon/Operational log. Sysmon's Process Create event records the image, command line, hashes, and both parent process ID and parent image for every new process, which is exactly the data needed to reconstruct a process tree after the binary is gone. Other artifacts such as Amcache, $MFT, and SRUM may show that a file existed or ran but do not preserve runtime parent-child relationships.

Answer

The SRUM database's Application Resource Usage table

Answer

The $MFT entries for the volume where the executable ran

Answer

The Amcache.hve registry hive's Root\InventoryApplicationFile key

Question 13

A forensic examiner is reviewing an NTFS volume from a Windows 11 laptop. The user claims a sensitive spreadsheet was only opened and never modified or renamed. The examiner notes that the $STANDARD_INFORMATION timestamps for the file are all recent, but the $FILE_NAME timestamps are from several months earlier. Which explanation best accounts for this discrepancy?

Accepted Answer

The file was accessed by a program that updated the $STANDARD_INFORMATION timestamps, and this behavior is a known anti-forensic technique or normal filesystem behavior depending on the API used.. NTFS maintains parallel timestamps in $STANDARD_INFORMATION and $FILE_NAME. Many APIs and many anti-forensic tools update only the $STANDARD_INFORMATION set, leaving $FILE_NAME untouched. A recent $STANDARD_INFORMATION paired with an older $FILE_NAME is a classic timestomping indicator and directly explains the discrepancy the examiner observed.

Answer

Windows 11 disables $FILE_NAME timestamp updates by default for user documents, so the older values simply reflect the file's creation date.

Answer

The $FILE_NAME timestamps record when the file was last backed up, while the $STANDARD_INFORMATION timestamps record live activity, so they legitimately differ after any backup.

Answer

The file was copied onto the volume from a remote share, which rewrote the $STANDARD_INFORMATION times while preserving the $FILE_NAME times from the source.

Question 14

An analyst is examining a Windows 10 host suspected of being used to stage and exfiltrate data. The analyst wants to identify evidence of files that were recently opened or created by the user, and of USB mass storage devices that were previously connected. Which two artifacts should the analyst examine to address these goals? (Choose two.)

Accepted Answer

The SYSTEM hive's USBSTOR key at ControlSet001\Enum\USBSTOR. RecentDocs in NTUSER.DAT preserves recently opened documents with shell item paths, addressing the recent-file goal, while the SYSTEM hive's USBSTOR key enumerates USB mass storage devices that were previously connected. Together they cover both investigative objectives. The other artifacts either record application usage, executable metadata, or network statistics, none of which map to the stated goals.

Answer

The RecentApps key under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Search

Answer

The Amcache.hve Root\File key

Answer

The SRUM database's Network Data Usage table

Question 15

An examiner is analyzing a Windows 10 endpoint and finds that the user account was deleted before acquisition, but the examiner still needs to determine which files that user recently opened from a network share. The user's profile folder was also removed. Which artifact is most likely to retain this information?

Accepted Answer

The Security event log's object access auditing entries in the Security.evtx file. Object access auditing, when enabled, writes file access events to the Security event log, which is system-scoped and stored under winevt\Logs, so it survives deletion of the user account and profile. Per-user hives such as NTUSER.DAT and UsrClass.dat are removed with the profile, and SRUM records resource usage rather than file opens.

Answer

The SRUM database's Application Resource Usage table

Answer

The NTUSER.DAT hive from the deleted user's profile folder

Answer

The UsrClass.dat hive from the deleted user's profile folder

Question 16

An examiner is reviewing a Windows 11 workstation seized during an insider-threat investigation. The suspect denies ever connecting removable media, but the examiner finds a file named 'E01' inside 'C:\Windows\INF\' with no corresponding setupapi.dev.log entries for USB devices. Which artifact should the examiner correlate to confirm the specific USB storage device that was connected and its serial number?

Accepted Answer

The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key is the authoritative artifact for identifying USB mass-storage devices that have been attached to a Windows system. Each subkey contains a unique device instance ID that includes the vendor, product, and serial number, allowing an examiner to confirm the exact device even when setupapi.dev.log entries are absent or incomplete. Correlating USBSTOR with other artifacts provides a robust evidentiary link.

Answer

The NTFS USN journal on the system volume

Answer

The MountedDevices registry key under HKLM\SYSTEM\MountedDevices

Answer

The Windows Portable Devices (WPD) registry key under HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices

GSEC Windows Forensics — All Questions With Answers

An examiner is investigating file execution history on a Windows 10 system. Which TWO registry keys store information about the most recently executed applications?

Which Windows artifact is most reliable for determining the original file path of a file that was deleted from a USB drive?

An examiner is analyzing the SYSTEM registry hive. Which THREE pieces of information can be derived from the 'MountedDevices' key?

A junior analyst is asked to determine whether a suspicious executable on a Windows 10 workstation was actually run, without relying on live memory. The executable has since been deleted from disk. Which artifact most directly indicates that this specific program executed on the host?

An incident responder needs to determine the last time a specific user interacted with a Windows workstation. Which registry hive should be analyzed to retrieve the LastWrite time of the user's NTUSER.DAT file?

Refer to the exhibit. An investigator is auditing logon events. Which Event ID indicates a successful network logon (Type 3) to the machine?

Exhibit

During a forensic examination, you find a Prefetch file named 'MALWARE.EXE-A1B2C3D4.pf'. What is the significance of the hexadecimal string appended to the filename?

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Exhibit

When investigating a Windows system, which file system feature is responsible for recording the file metadata including timestamps for created, modified, and accessed (MACE) times?

GSEC Windows Forensics — All Questions With Answers

An examiner is investigating file execution history on a Windows 10 system. Which TWO registry keys store information about the most recently executed applications?

Which Windows artifact is most reliable for determining the original file path of a file that was deleted from a USB drive?

An examiner is analyzing the SYSTEM registry hive. Which THREE pieces of information can be derived from the 'MountedDevices' key?

A junior analyst is asked to determine whether a suspicious executable on a Windows 10 workstation was actually run, without relying on live memory. The executable has since been deleted from disk. Which artifact most directly indicates that this specific program executed on the host?

An incident responder needs to determine the last time a specific user interacted with a Windows workstation. Which registry hive should be analyzed to retrieve the LastWrite time of the user's NTUSER.DAT file?

Refer to the exhibit. An investigator is auditing logon events. Which Event ID indicates a successful network logon (Type 3) to the machine?

Exhibit

During a forensic examination, you find a Prefetch file named 'MALWARE.EXE-A1B2C3D4.pf'. What is the significance of the hexadecimal string appended to the filename?

Refer to the exhibit. An investigator identifies this registry key. What is the primary purpose of this information in a forensic investigation?

Exhibit

When investigating a Windows system, which file system feature is responsible for recording the file metadata including timestamps for created, modified, and accessed (MACE) times?