Windows Forensics
9 practice questions under this official exam objective (312-49v10) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
Which Windows Artifact Best Reveals Deleted Folders and Mounted Drives?
Windows ShellBags, stored in the BagMRU and Bags registry keys, record Explorer folder views and can preserve evidence of deleted directories, mounted
Recovering Microsoft Edge Browser History with NirSoft Tools
Identifies the correct NirSoft utility and Windows file system path for recovering deleted Microsoft Edge browsing history in a forensic investigation
Why Were 14-Character Passwords Cracked So Quickly?
The question tests why a 14-character Windows password policy did not prevent rapid SAM-database cracking. The answer is A: legacy LAN Manager hashing
Which Tool Extracts Passwords and Hashes from SAM and SYSTEM Files?
PWdump7 is the Windows forensic utility used to parse SAM and SYSTEM registry hives and dump local user LM/NTLM password hashes. This page confirms wh
CHKDSK Primary Function in Windows Forensics
This question examines the primary function of the CHKDSK utility in Windows forensics, specifically its ability to repair logical file system errors.
Which Windows tool displays local and remote logged-on users?
This question tests whether you can distinguish Sysinternals tools by function and identify PSLoggedon as the utility that lists local and remote logg
Recycle Bin File Naming: What Does 'x' Represent?
This question tests knowledge of Windows Recycle Bin internal file naming conventions, specifically the meaning of the variable components in the Dxy.
NTLM Authentication Password Storage Location
Identifies the Security Accounts Manager (SAM) database as the correct storage location for NTLM password hashes on domain controllers. This page expl
Windows Registry Hive for Password Storage
This question examines the structure of the Windows Registry and identifies which hive stores user credentials. The correct location is HKEY_LOCAL_MAC