Chapter 16 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band are at the bottom. No peeking until you have committed to an answer — guessing teaches nothing.

Multiple choice

Q1. A senior examiner needs to reconstruct the history of USB mass-storage devices connected to a Windows workstation. Which registry hive is the primary source? - A) SAM - B) SYSTEM - C) SOFTWARE - D) NTUSER.DAT

Q2. You are analyzing a dead-box (powered-off) image. Which key path do you actually read for the active service and device configuration, since one common runtime path does not exist offline? - A) HKEY_CURRENT_USER\… - B) SYSTEM\CurrentControlSet\… - C) SYSTEM\ControlSet001\… (confirming via SYSTEM\Select\Current) - D) HKLM\HARDWARE\…

Q3. A 4624 (successful logon) event carries logon type 10. What does that indicate? - A) Logon at the physical keyboard (interactive) - B) A network share access over SMB - C) A remote interactive logon — RDP / Terminal Services - D) A service starting under that account

Q4. Which execution-related artifact stores a timestamp that is the file's $STANDARD_INFORMATION modified time — not the time the program ran? - A) Prefetch - B) Amcache - C) ShimCache (AppCompatCache) - D) UserAssist

Q5. What does the existence of a prefetch (.pf) file for an executable prove? - A) The program is currently running - B) The program was installed but never run - C) The program executed on this system at least once - D) The program was downloaded from the internet

Q6. While parsing USBSTOR, the device instance ID is 7&1c2e3f4&0. What does the second character being an ampersand (&) tell you? - A) The device is encrypted - B) Windows generated the ID because the device reported no unique serial — it is not reliable for cross-machine tracking - C) The device was connected twice - D) The serial is a SanDisk vendor code

Q7. Which artifact can prove that a user browsed a folder that no longer exists — for example, a folder on a thumb drive that was unplugged and taken away? - A) Prefetch - B) ShellBags (primarily in UsrClass.dat) - C) The Security event log - D) SAM

Q8. Security event ID 1102 records which occurrence? - A) A new service was installed - B) A user account was created - C) The Security event log was cleared - D) An unexpected shutdown

Q9. In the $Recycle.Bin`, what does the `$I file contain (as opposed to the $R file)? - A) The recoverable file content - B) The original path, original size, and deletion timestamp (metadata) - C) The user's password hash - D) A thumbnail of the file

Q10. Which combination of artifacts indicates a program executed, rather than merely being present on disk? - A) Amcache + ShimCache - B) ShimCache + Uninstall key - C) Prefetch + UserAssist (+ BAM/DAM) - D) SOFTWARE\…\Run + Amcache

True / False

Q11. Amcache and ShimCache both reliably prove that a program executed. (True / False)

Q12. The MFT $FILE_NAME` timestamps are generally harder for an ordinary user to forge than the `$STANDARD_INFORMATION timestamps that Windows Explorer displays. (True / False)

Short answer

Q13. You extract the SYSTEM hive and notice its base-block primary and secondary sequence numbers differ. In one or two sentences: what is the hive's condition called, and what must you do before you can trust its most recent values?

Q14. Name the three-key chain (and the hive each key lives in) that moves an examiner from "a device was connected to this computer" to "this specific user mounted this volume at this time."

---

Answer key

Q1 — B. SYSTEM holds CurrentControlSet\Enum\USBSTOR (device serials, install/arrival/removal times) and MountedDevices; SAM is accounts, SOFTWARE is installed programs, NTUSER.DAT is per-user.

Q2 — C. CurrentControlSet is a runtime symlink that does not exist offline; you read ControlSet001 (and sometimes 002) and confirm which was active via SYSTEM\Select\Current.

Q3 — C. Logon type 10 = RemoteInteractive (RDP/Terminal Services). Type 2 is interactive at the keyboard; type 3 is network; type 5 is service.

Q4 — C. ShimCache stores each entry's path plus its $STANDARD_INFORMATION modified time — never an execution time — and on Windows 8+ carries no reliable execution flag.

Q5 — C. A .pf file means the executable ran at least once; parsing it yields a run count, the last (up to) eight run times, and the files it loaded.

Q6 — B. A second character of & means Windows generated the instance ID because the device reported no unique serial; it is not globally unique and cannot anchor cross-machine identity — and you must say so in the report.

Q7 — B. ShellBags record folder-view preferences, which requires recording that the folder was visited — so they preserve paths (including on long-gone removable media) even after the device or folder is gone.

Q8 — C. Event 1102 = the Security log was cleared; it records who cleared it and when, and the resulting gap is itself a trace.

Q9 — B. $I` is the metadata record (original path, original size, deletion FILETIME); `$R is the recoverable content. The SID in the folder path attributes the deletion to a user.

Q10 — C. Prefetch, UserAssist, and BAM/DAM indicate execution; Amcache and ShimCache indicate presence. Distractors A, B, and D each lean on presence-only artifacts.

Q11 — False. Both prove a binary was present (Amcache adds a SHA-1 and compile time; ShimCache adds a path and $SI mod time). Neither, by itself, proves execution.

Q12 — True. $STANDARD_INFORMATION` can be set by any user with a timestomping utility (and is what Explorer shows); `$FILE_NAME is kernel-maintained and far harder to forge, which is why it anchors the truthful timeline.

Q13. The hive is dirty (sequence numbers unequal means the latest changes live only in the transaction logs). Before trusting recent values you must extract SYSTEM.LOG1/SYSTEM.LOG2 alongside the hive and use a parser that replays them; otherwise you analyze a stale registry.

Q14. USBSTOR (in SYSTEM) gives the device + serial → MountedDevices (in SYSTEM) links the device to a drive letter and volume GUID → MountPoints2 (in that user's NTUSER.DAT) contains the same volume GUID, attributing the mount to that user, with the key's last-write time approximating when.

Scoring: 13–14 — courtroom-ready; you can defend each artifact and its limits. 10–12 — solid grasp; revisit the execution-vs-presence table and the USB correlation chain. 7–9 — re-read "Execution evidence" and "Event logs," then redo Groups C and D in the exercises. Below 7 — re-read the chapter index and rebuild the anchor-case timeline before moving on.