300-215 Question 73
Select 3During an investigation of a suspicious activity on a Windows host, you are tasked with identifying and collecting files that could help determine the root cause. Which of the following files and their locations are most relevant for forensic analysis in this scenario?
- A
System Event Log located in C:\Windows\System32\winevt\Logs\System.evtx
- B
User's browser history located in C:\Users<username>\AppData\Local\Google\Chrome\User Data\Default\History
- C
System pagefile located in C:\pagefile.sys
- D
Windows Prefetch files located in C:\Windows\Prefetch
- E
Temporary files located in C:\Windows\Temp
- F
Driver logs located in C:\Windows\System32\drivers\log
Show answer and explanation
Correct answers: A, B, D
Explanation
For effective forensic analysis, files like System Event Logs, browser history, and Prefetch files are critical as they provide detailed insights into system and user activity. These files often reveal key evidence about the nature of the incident, such as when suspicious events occurred, what applications were executed, and what websites were visited. While other files like the pagefile or Temp files may sometimes contain relevant data, they are less practical and reliable for immediate forensic purposes.
- A. Correct.
System Event Logs are essential for forensic analysis as they provide detailed information about system events, crashes, and logon attempts. The location provided is correct for Windows systems.
- B. Correct.
Browser history files can provide insights into user activity, such as visited websites during the time of the incident. The path given is accurate for Chrome browser history on Windows.
- C. Incorrect.
The pagefile.sys file can occasionally contain fragments of data relevant to the investigation, but it is not as immediately useful as other files like logs or browser history due to its size and complexity to parse.
- D. Correct.
Windows Prefetch files help identify recently executed applications, which is crucial for understanding potential malware execution. The path provided is correct for prefetch files.
- E. Incorrect.
Temporary files in the Temp directory are generally less useful for forensic analysis because they are often overwritten and do not typically contain detailed information about user or system activity.
- F. Incorrect.
Driver logs do not usually provide significant forensic value unless the investigation is specifically focused on driver-related issues. Additionally, the location specified is not standard for Windows driver logs.