Windows Forensics: Registry, Event Logs, and System Artifacts
Published:
Questions
30
Duration
30 min
Faculty-reviewed
30
Updated
28 Apr 2026
About this mock
This mock covers Windows forensic artefacts in depth — the Registry hives, the Event Log infrastructure, Prefetch, ShimCache, Amcache, USB device tracking, ShellBags, UserAssist, RecentDocs, Jump Lists, LNK files, the NTFS journal files, Volume Shadow Copies, SRUM and the Recycle Bin. Thirty questions test what each artefact records, where it lives on disk, what tool to use to parse it, and what real-investigation question each artefact answers — who logged in, what programs ran, what USB drives were inserted, what files were opened, what was the user doing at 14:32.
It is pitched at BSc and MSc cyber forensics students at NFSU and similar Indian universities, certified examiner aspirants (CHFI, GCFE, GCFA), and FACT or state-FSL examinees who routinely face Windows-artefact questions. Windows desktop forensics is the largest single section in any practical cyber-forensics paper because the majority of seized devices in Indian cyber-crime cells are still Windows machines — knowing the artefacts cold is the difference between a competent examiner and a paper-only candidate.
Topics covered:
- Registry hive structure: SAM, SECURITY, SOFTWARE, SYSTEM, NTUSER.DAT, USRCLASS.DAT — and exactly where each file lives on disk
- USB insertion artefacts: USBSTOR, MountedDevices, MountPoints2 and setupapi.dev.log
- Persistence keys: Run, RunOnce, Services, Image File Execution Options
- ShellBags, RecentDocs, UserAssist, Jump Lists, LNK files — what each tells you about user activity
- Critical Event Log IDs: 4624, 4625, 4634, 4647, 4672, 4688, 4720, 7045, 1102 — what each means and when it fires
- Prefetch (.pf): up to 8 last-run timestamps in Windows 10+, the eviction rules
- ShimCache (AppCompatCache) and Amcache.hve — the differences and why both matter
- $MFT, $LogFile, $UsnJrnl — the NTFS forensic trio
- Volume Shadow Copies, SRUM (SRUDB.dat), the Recycle Bin ($I / $R files)
- Tooling: Eric Zimmerman tools (Registry Explorer, RECmd, EvtxECmd, MFTECmd, AmcacheParser, JLECmd, LECmd, RBCmd), KAPE, Autopsy, Magnet AXIOM
Each question carries a detailed explanation citing Microsoft Learn for the official artefact behaviour, Carvey Windows Registry Forensics and Windows Forensic Analysis Toolkit, Eric Zimmerman documentation, MITRE ATT&CK technique mappings, and Mandiant research where relevant. Allow 30 minutes — these are quick-recall questions that any practising examiner should answer in well under 30 seconds each. The explanations are long enough to use as study notes by themselves; even if you skip the timed run, reading through them once is a complete refresher.
Sources & references
Questions in this mock are written and verified against the following sources. Citations are recorded per question and shown in the explanation after submission.
- cited in 5 questions
Carvey, Harlan — Windows Registry Forensics
2nd Edition, Chapter 4: User Hive Analysis
- cited in 2 questions
Carvey, Harlan — Windows Forensic Analysis Toolkit
4th Edition, Chapter on USB Device Analysis
- cited in 1 question
Microsoft Learn — Audit Special Logon (Event 4672)
Event 4672(S): Special privileges assigned to new logon
Open source - cited in 1 question
Mandiant (FireEye) — Leveraging the Application Compatibility Cache in Forensic Investigations
ShimCache structure and execution-flag semantics
- cited in 1 question
- cited in 1 question
Microsoft Learn — Audit User Account Management (Event 4720)
Event 4720(S): A user account was created
Open source - cited in 1 question
- cited in 1 question
- cited in 1 question
- cited in 1 question
Microsoft Learn — Security Account Manager (SAM) Database
SAM hive structure and account storage
- cited in 1 question
Microsoft Learn — Per-User Class Registration
HKEY_CURRENT_USER\Software\Classes mapping to USRCLASS.DAT
- cited in 1 question
MITRE ATT&CK — T1547.001 Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution sub-technique
Open source - cited in 1 question
Microsoft Learn — Audit Process Creation (Event 4688)
Event 4688(S): A new process has been created
Open source - cited in 1 question
- cited in 1 question
SANS Digital Forensics — Jump Lists in Depth
AutomaticDestinations folder structure and DestList stream
- cited in 1 question
Microsoft — [MS-SHLLINK]: Shell Link (.LNK) Binary File Format
Section 2: Structures (ShellLinkHeader, LinkInfo, ExtraData)
Open source - cited in 1 question
Khatri, Yogesh — Forensic Implications of System Resource Usage Monitor (SRUM)
SRUDB.dat structure and ESE table layout
- cited in 1 question
- cited in 1 question
Microsoft Learn — Memory Manager Prefetcher
Prefetch directory and .pf file naming
- cited in 1 question
Microsoft Learn — Audit Logon (Event 4624)
Event 4624(S): An account was successfully logged on
Open source - cited in 1 question
- cited in 1 question
Microsoft Learn — System Event Log (Service Control Manager 7045)
Event 7045: A service was installed in the system
- cited in 1 question
Microsoft Learn — Recycle Bin Folder Structure
Windows Vista+ Recycle Bin layout ($I and $R files)
- cited in 1 question
Carrier, Brian — File System Forensic Analysis
Chapter 11: NTFS Concepts (MFT structure)
- cited in 1 question
Microsoft Learn — Audit Other System Events (Event 1102)
Event 1102(S): The audit log was cleared
Open source
How our mocks are built
Questions are written and edited by the ForensicSpot team and cited from peer-reviewed forensic textbooks, official syllabi and primary case law. Each one is verified before publishing. Detailed explanations show after you submit, so the test stays a real test. See a mistake? Tell us.
Common questions
What does the Windows Forensics: Registry, Event Logs, and System Artifacts mock cover?+
This mock covers Windows forensic artefacts in depth — the Registry hives, the Event Log infrastructure, Prefetch, ShimCache, Amcache, USB device tracking, ShellBags, UserAssist, RecentDocs, Jump Lists, LNK files, the NTFS journal files, Volume Shadow Copies, SRUM and the Recycle Bin. Thirty questions test what each artefact records, where it lives on disk, what tool to use to parse it, and what real-investigation question each artefact answers — who logged in, what programs ran, what USB drives
How many questions and how long is the test?+
30 multiple-choice questions, 30 minutes total. Difficulty: medium. Tier: Premium.
Who is this mock for?+
Forensic science students and aspirants who want timed, exam-style practice with explanations and verified source citations on Digital Forensics. Useful for postgraduate entrance preparation and for BSc / MSc forensic students testing their recall under time.
Are the questions reviewed?+
Yes — 30 of 30 questions are faculty-reviewed. Each question carries a verified source citation.
Do I need an account to take this mock?+
Yes, a free ForensicSpot account is required to start a timed attempt — this lets you save progress, see per-question explanations after submission, and track your topic-level performance over time.