Windows Forensics
16 practice questions under this official exam objective (312-49v10), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
16 total · page 1 of 1Which Windows Artifact Best Reveals Deleted Folders and Mounted Drives?
Windows ShellBags, stored in the BagMRU and Bags registry keys, record Explorer folder views and can preserve evidence of deleted directories, mounted
Recovering Microsoft Edge Browser History with NirSoft Tools
Identifies the correct NirSoft utility and Windows file system path for recovering deleted Microsoft Edge browsing history in a forensic investigation
Why Were 14-Character Passwords Cracked So Quickly?
The question tests why a 14-character Windows password policy did not prevent rapid SAM-database cracking. The answer is A: legacy LAN Manager hashing
Which Tool Extracts Passwords and Hashes from SAM and SYSTEM Files?
PWdump7 is the Windows forensic utility used to parse SAM and SYSTEM registry hives and dump local user LM/NTLM password hashes. This page confirms wh
Which Perl Script Accesses a Process Executable Image?
This CHFI 312-49v10 question tests knowledge of the small Perl utility scripts used during live process analysis to locate a process's executable imag
CHKDSK Primary Function in Windows Forensics
This question examines the primary function of the CHKDSK utility in Windows forensics, specifically its ability to repair logical file system errors.
TSK istat Command for Inode Block Analysis
This question tests the use of The Sleuth Kit (TSK) command-line tools for examining ext4 inode metadata in Linux forensics. It establishes that the '
Isolating a Process for Memory Dump Analysis
This question examines Windows memory analysis techniques using Microsoft's DumpChk tool. The correct approach involves extracting the specific proces
Windows Service Start/Stop Event IDs for Forensics
Identify the specific Windows System log Event IDs (7035 and 7036) that track service state changes to detect suspicious start/stop activity during a
Which Windows Event ID Tracks Registry Value Changes?
When analyzing a suspicious executable in a controlled Windows environment, analysts can use Event Viewer to detect registry modifications. Event ID 4
Where MSSQL Database Logs Are Stored
When hunting for attack evidence in an MSSQL database, an examiner must locate the transaction log, which records every change made to the database. T
Which Windows tool displays local and remote logged-on users?
This question tests whether you can distinguish Sysinternals tools by function and identify PSLoggedon as the utility that lists local and remote logg
Extracting Google Drive Artifacts with RegScanner
When Google Drive is installed on a Windows host, it persists settings, account identifiers, sync metadata, and path information in the Windows Regist
Recycle Bin File Naming: What Does 'x' Represent?
This question tests knowledge of Windows Recycle Bin internal file naming conventions, specifically the meaning of the variable components in the Dxy.
NTLM Authentication Password Storage Location
Identifies the Security Accounts Manager (SAM) database as the correct storage location for NTLM password hashes on domain controllers. This page expl
Windows Registry Hive for Password Storage
This question examines the structure of the Windows Registry and identifies which hive stores user credentials. The correct location is HKEY_LOCAL_MAC