Timelining

Which of the following artifacts are considered as the Windows Forensic Trinity?

• Filesystem Metadata

• Registry

• Windows Event Logs

• Windows Startup

Answer explanation

The three core areas of focus are filesystem metadata, windows artifact data, and Windows registry information.

Understanding all three areas and how they interrelate is a skill worth working towards.

What point is used to examine the temporal proximity in the timeline?

• Slope Point

• Pivot Point

• Parrot Point

• No Point

Answer explanation

Use the pivot to look before and after in your timeline to get a better idea of what

happened on the system

NTFS Timestamps: Time the data content of a file was last modified

• M

• A

• C

• B

The most famous super timeline tool is Plaso

• True

• False

If you are in a rush, is it better to create a supertimeline? Why or Why not?

• Yes. Supertimeline is quicker to generate than filesystem timeline.

• No. Just do filesystem timeline. Supertimeline is not a quick process to run

• No. I don't want to do timelining

• Yes. Supertimeline is not a quick to generate and I like to provide the analysis the next day.

What tool outputs metadata about the events extracted from log2timeline

• plasm

• pinfo

• fls

• mactime

Which of the following can be detected by timeline analysis?

• Anti-Forensics

• Covert Tunneling

• Covid

• Influenza

What tool can be used to filter events collected by log2timeline

• mactime

• psort

• plasm

• prost

When examining a system that has been mounted as a virtual image, which of the following techniques could identify persistent malware?

• Check for current PIDS in NTUSER.DAT

• Examining the broadcast address for the system in HKLM\System\CurrentControlSet\Services\VxD\MSTCP

• Examining the size of pagefile.sys in HKLM\System\CurrentControlSet\Control\SessionManager\MemoryManagement

• Checking for apps that start automatically in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The image shows the SI and FN times for files in the C:\temp directory. Which of the following files contains normal file attributes?

• pears.txt

• lemons.txt:limes.txt

• apples.txt

• bananas.txt