CCNA Windows Artifact Analysis Questions

Windows disables last access time updates by default to improve performance. This behavior is controlled by the registry value NtfsDisableLastAccessUpdate, which is set to 1 by default in modern Windows versions. Therefore, the last access time is not updated when files are accessed, explaining why the analyst sees no recent timestamp.

Image File Execution Options (IFEO) is the correct registry location. Attackers can create a subkey named after a legitimate executable (e.g., notepad.exe) and set a Debugger string value pointing to their malicious binary. When the legitimate executable is launched, Windows starts the debugger instead, achieving persistence and execution. This matches the scenario.

Each subkey under HKLM\SYSTEM\CurrentControlSet\Services represents an installed service and contains values such as ImagePath (the executable path) and ObjectName (the account the service runs under). This is the primary location for service configuration, making it the correct choice for identifying the original path and account.

The PowerShell Operational log (Microsoft-Windows-PowerShell/Operational) records detailed information about PowerShell execution, including script block logging (Event ID 4104) and engine state changes. If script block logging is enabled, the actual commands executed are captured, making this the correct artifact for determining the exact PowerShell commands used.

This policy, when enabled, adds the full command line to the Process Creation event. Without it, Windows records the new process ID and image name but leaves the command line field blank. Enabling it requires a Group Policy update or registry change and is not on by default even when process creation auditing is active.

The $I file is a metadata file created alongside the $R file (which contains the actual deleted data) when a file is deleted to the Recycle Bin. It stores the original file path, the deletion timestamp, and the file size. Examining the $I file provides the original path and deletion time, directly answering the analyst's question.

Setupapi.dev.log records device installation and driver setup events, including USB devices. It can contain the device's vendor and product IDs, serial number, and timestamps of when the device was first connected. This makes it a valuable artifact for corroborating USB connection, especially when USBSTOR is cleared.

TypedPaths records the history of directory paths the user manually typed into the File Explorer address bar. This provides a direct record of the user's navigational intent, which is particularly useful for identifying access to sensitive directories that are not typically visible through standard menu-based browsing.

RecentDocs keys under NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs store lists of recently opened documents and folders, organized by file extension. They provide evidence of user activity, such as which files were accessed, and can help establish a timeline of user interactions. This is valuable for identifying potential data exfiltration or unauthorized access to sensitive files.

Event ID 4624 in the Security log records successful logons and includes the Logon Type field. Type 2 indicates interactive logon at the console, while Type 10 indicates RemoteInteractive (RDP). These events provide the account name, timestamp, and logon type, directly answering who was logged on interactively and when, assuming the log has not been cleared or overwritten.

The USBSTOR key under Enum stores information about USB mass storage devices that have been connected to the system. Each subkey corresponds to a device and includes the vendor, product, and revision, as well as a serial number if available. This is the primary artifact for determining USB storage device connection history.

The USBSTOR key in the SYSTEM hive acts as a central repository for all USB device connections. It stores the vendor, product ID, and serial number of the device. Even after the device is disconnected, this entry remains, providing a permanent record of the hardware's interaction with the system.

Shimcache stores the file path and the last modified time of the executable. This helps the OS determine if a file is compatible. For forensics, this artifact is essential for identifying executable files that existed on the system, even if those files were subsequently deleted by an attacker.

PsExec installs a temporary service named PSEXESVC on the target system. The installation of this service is recorded in the System event log with Event ID 7045, which includes the service name, image path, and service type. This provides strong evidence that PsExec was used, especially if the service name matches PSEXESVC.

UserAssist is located in the NTUSER.DAT hive, which is unique to each user profile on the system. It tracks the programs the user launches via the Windows shell, recording execution counts and timestamps, making it the primary artifact for identifying user-driven activity during an investigation.

The .lnk file (shortcut) contains a LinkTargetIDList and other structures that store the original target path, as well as command-line arguments if present. By parsing the .lnk file, the analyst can extract the full path and any arguments, making it the correct artifact for this purpose.

The MFT stores the attributes for every file on an NTFS volume. The 'Hidden' attribute flag, when set, instructs the operating system to omit the file from standard folder views. Identifying this flag is essential for uncovering files that the attacker intentionally obscured from the user.

Event 4697 tracks service installation. Attackers often install services to maintain persistence, ensuring their malware runs with high privileges after a reboot. Detecting this event allows the investigator to extract the service path and identify the malicious binary that was dropped and registered for automatic execution.

ShellBags registry keys are updated when a user opens a folder. Because these keys persist even after folders are deleted, they are excellent evidence for showing the user was present in a directory. This helps confirm user knowledge of specific files or directories during a forensic examination.

Security Event ID 4624 with Logon Type 3 indicates a network logon, which occurs when a user accesses a remote share. It records the account name, logon time, and source network address. This directly evidences remote file share access, making it a primary artifact for the scenario.

The MFT acts as the central index of the NTFS file system. It contains critical metadata like timestamps and data pointers for every file. This is the foundation of digital forensic file analysis, enabling investigators to recover evidence of files, even after they have been deleted by users.

Prefetch files are created when an executable is run, and they record execution time and run count. If a Prefetch file exists for the malicious executable, it confirms that the program was executed on the system. ShimCache only indicates that the file was present and may have been executed, so Prefetch provides the necessary confirmation.

The .automaticDestinations-ms extension is used for the files stored in the AutomaticDestinations folder. These files contain lists of recently accessed items for a specific application. Identifying these files allows an analyst to extract document names, folder paths, and timestamps related to the user's recent file interaction history.

Prefetch files are created when an executable is run, and they record the last execution time and run count. The presence of a prefetch file for POWERSHELL.EXE indicates that PowerShell was executed on the system. The timestamp embedded in the .pf file can be parsed to determine the last execution time, which is valuable for timeline analysis.

Sysmon Event ID 1 logs detailed process creation events, including the exact UTC timestamp, process GUID, image path, command line, and parent process ID. This directly answers when the process started and its parent-child relationship. If Sysmon was installed and configured, this is the most precise and reliable artifact for the scenario.

Event ID 4698 is generated when a scheduled task is created. It includes the task name, the user account that created it, and a timestamp. This directly answers the question of when the task was registered and who registered it, making it the most reliable artifact for this scenario.

The SAM hive is the repository for local user accounts. It stores account names, group membership, and password hashes. For forensic examiners, this is the primary source for identifying users on the system and potentially cracking passwords to determine the level of access an attacker gained.

The Services registry key stores configuration for each installed service. When a service is created or modified, the LastWrite time of its subkey under CurrentControlSet\Services is updated. This timestamp persists even if the executable is deleted and event logs are cleared, providing a reliable forensic indicator of when the service was installed or last altered. Analysts can correlate this with other artifacts to confirm the installation time.