Windows Execution Artifacts: Prefetch, Jump Lists, and LNK Files
Which TWO of the following are valid artifacts for determining program execution on a Windows system? (Select TWO.)
Quick Answer
The answer is Prefetch files and Jump Lists. Prefetch files are valid artifacts because they store execution information for applications, including the last run time and run count, directly indicating program execution on a Windows system. Jump Lists complement this by tracking recent files opened by specific applications, thereby revealing usage patterns and confirming that a program was actively used. On the Computer Hacking Forensic Investigator CHFI exam, this tests your ability to distinguish between execution artifacts and mere presence artifacts like LNK files, which can be created without execution. A common trap is assuming all shortcut files prove execution, but only Prefetch and Jump Lists provide direct evidence of a program actually running. To remember, think of Prefetch as the “program’s memory” of being launched, and Jump Lists as the “user’s recent activity log” tied to that program.
⚠ Common exam trap
EC-Council often tests the distinction between artifacts that record normal execution (Prefetch, Jump Lists) versus those that capture system state or errors (Pagefile, Restore Points, WER logs), leading candidates to overestimate the forensic value of Pagefile.sys or System Restore points.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Jump Lists
Jump Lists (C) are correct because they store recently accessed files and applications per user, providing a timeline of program execution. Prefetch files (D) are correct because they contain execution counts, timestamps, and file paths for applications launched on Windows, directly indicating program execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pagefile.sys
Why it's wrong here
Pagefile is virtual memory, not a direct execution artifact.
- ✗
System Restore points
Why it's wrong here
Restore points store system state, not program execution details.
- ✓
Jump Lists
Why this is correct
Jump Lists record recently accessed files per application, showing usage.
- ✓
Prefetch files
Why this is correct
Prefetch files contain execution count and last run time for applications.
- ✗
Windows Error Reporting logs
Why it's wrong here
Error reporting logs capture crashes, not normal execution.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which Windows artifact is primarily used to determine the execution history of applications, including the path and run count?
easy- A.LNK files
- B.Jump lists
- ✓ C.Prefetch files
- D.Event logs
Why C: Prefetch files (.pf) are created by Windows to speed up application startup by caching data about the files loaded during the first few seconds of execution. Each prefetch file records the application's path, the number of times it has been run (run count), and the last execution timestamp, making it the primary artifact for determining execution history.
Variation 2. Which TWO of the following are Windows artifacts that can provide evidence of file execution, including timestamps and paths?
medium- A.Event ID 4720
- B.SAM registry hive
- ✓ C.Prefetch files (*.pf)
- D.Pagefile.sys
- ✓ E.LNK files
Why C: Prefetch files (*.pf) are created by Windows to speed up application startup; they record the first time an application is executed, the full path to the executable, and the number of times it has been run. LNK files (shortcuts) are created when a user or the system accesses a file or application, storing the target path, creation timestamp, and last access timestamp, making both artifacts critical for proving file execution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.