Windows Artefacts

A system contains 1 disk with 2 NTFS partitions. How many $MFT files are present?

• 2
• 4
• 3
• 1

What is the path for the five main registry hives, DEFAULT, SAM, SECURITY, SOFTWARE, and SYSTEM?

• C:\Windows\config

• C:\Windows\System32

• C:\Windows\System32\config\

• C:\Windows\

By default, is Prefetch enabled on Windows desktop (workstations)?

• Yes

• No

Which artefacts provide the last execution time of an executable?

• Amcache

• Prefetch

• Shimcache

• UserAssist

Which execution artefacts can be associated with a specific user?

• UserAssist

• Amcache

• Shimcache

• SRUM

What is the Windows Prefetch?

• A caching mechanism to optimize the performance of frequently used files.

• A backup utility for system files.

• A tool for uninstalling applications.

• A security feature that encrypts files.

What is the main purpose of the Shimcache?

• To provide a backup of system files and settings.

• To manage user permissions for installed software.
• To provide compatibility for old applications.

• To enhance the performance of applications during execution.

Which information does the Amcache track?

• System hardware configurations.

• Network traffic and bandwidth usage.

• User login times and locations.

• Executed applications, including file paths and timestamps.

A threat actor cleared the event logs. Which artefacts could help recover the missing events?

• Windows Registry

• Powershell command history

• Backup logs

• Volume shadow copies

A threat actor gained remote access to a system using RDP.
On the target host, where can you find their source IP address?

• Security tooling logs (AV, EDR)

• Event Logs

• $MFT

• Windows Registry