CHFI OS and Network Forensics Practice Question
A forensic analyst is examining a Windows system and finds that the UserAssist key in the NTUSER.DAT hive contains entries with Rot13-encoded names. What is the primary purpose of the UserAssist key?
⚠ Common exam trap
Many exam-takers confuse the Rot13 encoding as a security feature for hiding passwords or sensitive data, when in fact it is merely a weak obfuscation of program paths and has nothing to do with password storage or USB tracking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Log program execution counts and last run times
The UserAssist key in the NTUSER.DAT hive is designed to track program execution counts and the last time each program was run by the user. The Rot13 encoding of the subkey names is a lightweight obfuscation to hide the logged application paths, but the core purpose remains forensic artifact for user activity timeline reconstruction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Record USB device connection history
Why it's wrong here
Under UserAssist, the key tracks program execution metadata, not USB devices. USB connection history is recorded separately in the USBSTOR and MountedDevices keys within the SYSTEM registry hive, where forensic tools inspect device serial numbers, VID/PID, and first/last insertion timestamps. UserAssist only stores ROT13-obfuscated executable paths, run counts, and last-run times, so it provides no information about USB device insertion or removal.
- ✗
Store user password history
Why it's wrong here
Storing user password history is an authentication-domain function, not an application-execution artifact. Windows persists password hashes and password history in the SAM hive (HKLM\SAM) and in domain controllers in NTDS.dit, while individual user profiles do not store such secrets. UserAssist values are simply execution counts and timestamps for launched executables; they contain no authentication material, so this option is unsupported by the artifact.
- ✓
Log program execution counts and last run times
Why this is correct
UserAssist is a per-user registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count that records GUI applications launched through Windows Explorer. Each value contains the ROT13-obfuscated path of an executable, with an embedded binary payload representing the number of times it was executed and the last execution timestamp encoded as a FILETIME. Forensic analysts decrypt the ROT13 and parse the binary data to prove a specific program was run, how often, and when, which is exactly what this correct answer describes.
- ✗
Track recently opened documents via Jump Lists
Why it's wrong here
Jump Lists are separate artifacts that also reveal user activity, but they focus on recently opened documents and application destinations rather than generic executable run counts. These files live under C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations and CustomDestinations, storing MRU entries that point to specific files and URLs. UserAssist does not track document-level paths; it only tracks the execution of the programs themselves, so this option confuses two distinct forensic evidence sources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.