Digital Forensicseasy Premium
Digital Forensics: Windows, Linux and macOS System Artifacts
Published:
Questions
30
Duration
30 min
Faculty-reviewed
0
Updated
20 May 2026
Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.
Published:
Questions
30
Duration
30 min
Faculty-reviewed
0
Updated
20 May 2026
Score, per-question explanations and topic breakdown shown right after you submit.
Free ForensicSpot account required to save your progress — you’ll sign in when you start.
FACT digital forensics drill on operating-system artefacts across Windows, Linux, and macOS, covering NTFS Master File Table internals, registry hives (HKLM\SYSTEM, NTUSER.DAT, SAM, SOFTWARE), event logs in .evtx form, LNK shortcuts, prefetch (.pf) files, the $Recycle.Bin with paired $I and $R files, shellbags, Volume Shadow Copies and System Restore, pagefile.sys, hiberfil.sys, NTFS Alternate Data Streams and slack space, plus the Linux Filesystem Hierarchy Standard, SUID/SGID/sticky semantics, /etc/passwd vs /etc/shadow, wtmp/btmp/lastlog/auth.log, bash history, cron persistence, syslog and rsyslog, auditd, /tmp vs /var/tmp, mount tables, and symlink vs hard link semantics. The macOS half covers launchd LaunchDaemons and LaunchAgents, SystemConfiguration preferences.plist, .fseventsd and other hidden directories, Unified Logging via the log show command, ~/Library plists, plutil binary-to-XML conversion, the login.keychain-db and System.keychain stores, zsh history on Catalina and later, Time Machine Backups.backupdb, and Safari and Chrome browser artefacts. Easy band calibration: distractors are clearly different concepts rather than near-twin paths.
For FACT aspirants, NFSU MSc digital forensics entrants, and candidates preparing for GCFA, CHFI, or SANS FOR500/FOR518. Questions emphasise canonical paths, default file names, and the single forensic role of each artefact, so the student can build a reliable mental map before moving on to scenario-driven medium and hard mocks.
Topics covered:
Useful for revision and self-testing before the FACT digital forensics paper.
Allow 30 minutes.
Questions are written and edited by the ForensicSpot team and cited from peer-reviewed forensic textbooks, official syllabi and primary case law. Each one is verified before publishing. Detailed explanations show after you submit, so the test stays a real test. See a mistake? Tell us.