CHFI OS and Network Forensics Practice Question
During a forensic investigation, you find a prefetch file created at 03:15:22 UTC on the system. The corresponding executable's last modified timestamp is 02:30:00 UTC, and the system date/time shows a discrepancy of +5 minutes. What is the MOST accurate interpretation regarding the file execution time?
⚠ Common exam trap
The CHFI exam often tests the misconception that the executable's last modified timestamp or the prefetch file's internal 'last run time' is the primary indicator of execution time, when in fact the prefetch file's creation timestamp is the key for first execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The program was executed at 03:10:22 UTC after adjusting for clock skew.
The prefetch file creation timestamp records the system time at execution. The system clock is +5 minutes ahead, so actual UTC at execution is 03:10:22 (03:15:22 minus 5 minutes). Option D correctly adjusts for this clock skew. Option B is wrong because it ignores the clock discrepancy, which is a known issue in forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The program was executed at 02:30:00 UTC.
Why it's wrong here
In NTFS, the executable's last-modified timestamp (02:30:00 UTC) records the last time the binary's content was changed on disk, and is stored in the file system metadata rather than in any execution log. This timestamp reflects when an update or installation altered the file, not when the prefetch-based execution tracking occurred. Prefetch files record execution via their own creation and last-write timestamps, and the creation timestamp here falls in the 03:xx UTC range after skew correction. Thus, 02:30:00 UTC has no direct probative value for execution timing.
- ✗
The program was executed at 03:15:22 UTC.
Why it's wrong here
The prefetch file's creation timestamp is 03:15:22 in system local time, but the computer's clock is +5 minutes fast relative to UTC. Ignoring that skew would misstate the actual UTC moment of first execution as 03:15:22, whereas the correct UTC value is 03:10:22. Prefetch creation time corresponds to the first time the program was run, so the raw value must be normalized for clock drift before being reported. Therefore, 03:15:22 UTC is the unadjusted local time and is not the correct UTC execution time.
- ✗
Execution time cannot be determined from prefetch files alone.
Why it's wrong here
Prefetch files are specifically designed to speed up application startup and in doing so retain execution artifacts: the creation timestamp of the .pf file indicates the first execution, and the last-write timestamp is updated on subsequent runs. A forensic examiner can therefore determine both first and last execution times from the prefetch file's timestamps, even though the file does not contain a complete history of every individual run. Since the prefetch file here has a creation time that establishes an initial execution at 03:10:22 UTC after skew adjustment, it is incorrect to claim that execution time cannot be determined from prefetch files alone.
- ✓
The program was executed at 03:10:22 UTC after adjusting for clock skew.
Why this is correct
The prefetch file was created at system time 03:15:22, but the system clock is +5 minutes fast, so the actual UTC time is 03:10:22. This option correctly adjusts for clock skew and is the most accurate interpretation.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.