CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

During a malware investigation at a tech firm in Miami, a forensic team is analyzing an imaged Windows 10 workstation (E01 format) assigned to an internal developer. Initial indicators of compromise (IoCs) point to the execution of a suspected data exfiltration tool, roughly 48 hours before the machine was taken offline.

However, analysts suspect that the attacker attempted to conceal their activity. A sweep of the `C:\Users\Developer\Downloads` and `C:\Windows\Temp` directories revealed that several executable files have been permanently deleted, and the MFT records for those specific entries have been overwritten. The investigation must now pivot to identify alternative artifacts that confirm execution and expose the attacker's tracks.

Evidence Collected

Question

Question 10: During a malware investigation at a tech firm in Miami, forensic analysts suspect that the attacker attempted to conceal activity by removing traces of previously executed programs on the compromised workstation. What source of evidence would best allow investigators to reconstruct execution activity and identify attempts to remove traces of prior programs?

Expert Analysis

1. What evidence shows:

The forensic extraction of the NTFS file system revealed that the primary executable was deleted. However, a `.pf` artifact (`EXFIL_TOOL_V2.EXE-4A8B9C2D.pf`) was recovered from `C:\Windows\Prefetch`. This artifact contains hard timestamps indicating the exact time the malicious binary was executed, the number of times it was run (Run Count: 3), and its original location path.

2. Identify forensic stage:

Examination & Analysis phase. The investigator is analyzing extracted artifacts to reconstruct the timeline of events.

3. Why correct answer is correct (A):

A. Prefetch files: Windows Prefetch is an operating system mechanism designed to speed up application load times. When an application is executed, Windows creates a `.pf` file in `C:\Windows\Prefetch`. Forensic investigators use these files to prove execution, determine execution counts, last run times, and map the directories/files the application interacted with within its first 10 seconds of execution. Because Prefetch files remain even after the original executable is deleted, they are critical for defeating anti-forensic techniques like file deletion.

4. Why others are wrong:

• B. Clipboard contents: The clipboard exists in volatile memory (RAM). While it might contain copied text at the time of collection, it does not provide historical execution logs or survive a reboot, making it useless for reconstructing historical execution of deleted programs.
• C. File Hash values: Hash values (MD5, SHA-1) are used during the Preservation phase to ensure data integrity and chain of custody, or to identify known malicious files. A hash value itself does not log execution times or trace application behavior.
• D. Openfiles command output: The `openfiles` command is a live response tool used to display files currently opened by local or network users. It does not provide historical data regarding previously executed and deleted files.

5. Real-world forensic action:

An investigator would extract the `C:\Windows\Prefetch` directory from the forensic image and parse the `.pf` files using a tool like Eric Zimmerman's PECmd. The output would be exported to CSV to be correlated against the timeline of other events (like the Event Log clearing at 15:00:00 UTC) to build a comprehensive timeline of the attacker's actions.