CHFI OS and Network Forensics Practice Question
Which TWO Windows artifacts can be used to identify recently accessed files or folders on a system? (Select the two best answers.)
⚠ Common exam trap
The CHFI exam often tests the distinction between artifacts that record file/folder access (LNK, ShellBags) versus artifacts that record program execution (Prefetch) or system-level events (Event IDs), leading candidates to mistakenly select Prefetch files or Event ID 4624.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LNK files
LNK files (option D) are Windows shortcut files that store a reference to the original target file or folder, including its path, volume information, and timestamps, and they are created or updated when a user opens a document or folder, making them a direct indicator of recent access. ShellBags (option E) are registry entries (in NTUSER.DAT under HKCU\Software\Microsoft\Windows\Shell) that record folder view settings and paths the user has browsed in Explorer, so they reveal folders that were accessed even if the folder no longer exists. Event ID 4624 (option A) is a Security log entry for successful logon events and does not record file or folder access. The SAM hive (option B) stores local user account and password hash data, not file access history. Prefetch files (option C) record execution of applications to speed up subsequent launches, not the opening of individual files or folders.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Event ID 4624
Why it's wrong here
Event ID 4624 is a Windows Security log event for successful logons, recording the user account, source address, and logon process. It does not capture file-level access or recently opened documents because file system object access requires separate audit policies (e.g., SACL entries) that generate Event IDs 4656/4663. Therefore, 4624 is unrelated to identifying recently accessed files.
- ✗
SAM hive
Why it's wrong here
The SAM hive (Security Accounts Manager registry hive) stores local user account credentials, including NTLM password hashes and account lockout policies, under SYSTEM\CurrentControlSet\Control\Lsa. It contains no timestamps or references to file opens, folder navigations, or user document activity. Forensic use of the SAM hive focuses on password recovery and user enumeration, not on identifying recently accessed files.
- ✗
Prefetch files
Why it's wrong here
Prefetch files (.pf) in C:\Windows\Prefetch are designed to speed up application startup by caching executables and DLLs, recording the last run time and run count of each application. While a prefetch file may reference the full path of the executable and some loaded components, it does not list every individual document or data file a user opened within that application. Thus, Prefetch is useful for program execution forensics but cannot directly identify recently opened files.
- ✓
LNK files
Why this is correct
LNK files (Windows shortcuts) are automatically created when a user accesses a file or folder, particularly in locations like the Recent folder (%AppData%\Microsoft\Windows\Recent), desktop, or Start Menu. These shortcut files embed the target path, creation timestamp, last written timestamp, and even the volume serial number of the drive, making them excellent evidence of recently opened documents. Forensic tools can parse LNK metadata to reconstruct user file access activity, even if the original file has been deleted.
- ✓
ShellBags
Why this is correct
ShellBags are Registry keys under HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell (BagMRU and Bags) that store folder view settings and navigation history. Each time a user opens a folder in Windows Explorer, a unique tracker entry is created or updated, preserving the folder path, view mode, and last accessed time. This makes ShellBags a highly persistent artifact for showing recently accessed folders and directories, and they remain even after those folders are deleted.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.