CHFI OS and Network Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  NTUSER.DAT

  Why it's wrong here

  NTUSER.DAT is the per-user registry hive that exists under C:\Users\<username>, storing user-specific configuration and application settings. Although it can contain MRU lists and RecentDocs entries that reference file names potentially opened from a USB drive, it does not directly record the device's vendor ID, serial number, or connection history. Forensic examiners would not rely on this hive as a primary artifact for identifying USB devices, because it reflects user activity rather than device enumeration.

• ✓

  HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

  Why this is correct

  The registry key HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR is one of the most reliable artifacts for identifying USB storage devices. Under this key, each subkey corresponds to a specific device class and serial number, such as 'Disk&Ven_Kingston&Prod_DataTraveler&Rev_1.00' followed by the unique instance ID. It persists on the system even after the device is unplugged, enabling examiners to prove that a particular USB flash drive or external hard drive was connected at some point. This makes it a cornerstone of USB device forensic analysis.

• ✗

  prefetch files

  Why it's wrong here

  Prefetch files are created by Windows to speed up the loading of executable programs and are stored in C:\Windows\Prefetch with the .pf extension. They record execution details such as the number of times a program was run and the last run time, but they do not enumerate hardware devices or document when a USB drive was connected. While a prefetch entry for an executable that resides on a USB drive could circumstantially suggest the drive was present, it lacks the unique device identifier needed to identify the USB device itself.

• ✓

  setupapi.dev.log

  Why this is correct

  The setupapi.dev.log file, located in C:\Windows\inf, is a detailed text log generated by Windows Setup and device installation APIs. It records each hardware installation attempt, including the exact time a USB device was connected, its hardware/device instance ID, and whether a driver was successfully installed. Unlike USBSTOR, which only tracks mass storage devices, this log can also evidence the connection of non-storage USB peripherals such as mice, webcams, and wireless adapters, making it a complementary artifact for building a complete timeline of USB activity.

• ✗

  Event ID 7045

  Why it's wrong here

  Event ID 7045 is a System event log entry that records the installation of a new Windows service, including the service name and the path to its executable. It is not related to USB device enumeration, and it does not contain information about connected USB hardware, such as serial numbers or bus addresses. The presence of this event only indicates that a service entry was created, which could be significant in malware investigations but is irrelevant to the identification of USB devices.

Go deeper

Related to this question