CHFI OS and Network Forensics Practice Question
A forensic examiner recovers a Windows 10 system and finds a prefetch file for powershell.exe with a last run time of 3 days ago, but the system's security logs show no interactive logons from that user. What does this discrepancy suggest?
⚠ Common exam trap
EC-Council often tests the misconception that prefetch files only record user-initiated executions, leading candidates to assume the timestamp must be wrong or that the user must have logged on, when in fact prefetch captures all executions including those from system services and scheduled tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PowerShell was executed as part of a scheduled task or service
A is correct because PowerShell.exe can be executed by non-interactive processes such as scheduled tasks or services, which do not generate interactive logon events (Event ID 4624) in the Security log. The prefetch file records the last run time regardless of the execution context, so a discrepancy between the prefetch timestamp and the absence of interactive logons indicates that PowerShell was launched by a system-level or automated mechanism, not by a user logging on interactively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PowerShell was executed as part of a scheduled task or service
Why this is correct
PowerShell launched via a scheduled task or service executes under logon type 4 (batch) or 5 (service), not interactive logon type 2. Consequently, the Security log will not contain a corresponding 4624 interactive logon event, even though prefetch records the powershell.exe execution with a valid last run time. This exactly matches the observed discrepancy, making non-interactive execution the correct forensic explanation.
- ✗
The prefetch file is corrupted
Why it's wrong here
Prefetch file corruption typically manifests as parsing errors, unrecoverable missing entries, or an inconsistent binary structure, yet it does not generate a plausible last run time. A corrupted prefetch file would either fail to report a timestamp or produce a nonsensical value, whereas the examiner found a coherent last run time that aligns with other artifacts. Moreover, prefetch files track application execution, not user authentication, so corruption cannot account for the absence of logon events.
- ✗
The user deleted their profile
Why it's wrong here
Deleting a user profile removes the user's registry hive (NTUSER.DAT) and profile directories, but it has no effect on system-wide prefetch files or the Security event log, which are maintained independently by the operating system. The Winlogon and LSASS processes generate logon events before profile loading completes, and those events remain in the Security log even if the profile is later deleted. Thus, profile deletion neither removes existing 4624 event records nor prevents the creation of new logon events.
- ✗
The system clock was changed
Why it's wrong here
Changing the system clock shifts the timestamps recorded for subsequently generated events, but it does not retroactively delete or suppress existing Security log entries. If a user logged on interactively, an event ID 4624 would still be written with the manipulated timestamp, not omitted entirely. The absence of any match in the specified time window therefore cannot be attributed to clock skew; the event would simply appear at a different time.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.