CHFI (312-49) Digital Forensics Simulation

Welcome to this digital forensics scenario. You will identify and interpret common file extensions found during a filesystem analysis, focusing on how OS and application records are stored.

Investigation Scenario

During a forensic examination of a suspected insider data exfiltration case at a defense contractor in Virginia, an analyst has created a bit-stream image of the suspect's Windows 10 workstation. While parsing the filesystem using X-Ways Forensics, the investigator discovers a hidden directory at C:\Users\Public\AppData\Local\Temp\.

Inside this directory, alongside several encrypted archives, the investigator locates a file named sync_transfer.LOG. The file's timestamp aligns perfectly with the timeframe of the suspected unauthorized network transfer.

Evidence Collected

> CASE ID: INV-2026-118-VA > FILE PATH: C:\Users\Public\AppData\Local\Temp\sync_transfer.LOG > FILE SIZE: 14 KB > MD5 HASH: d41d8cd98f00b204e9800998ecf8427e --- ARTIFACT HEX VIEW EXCERPT --- 00000000 32 30 32 36 2D 30 34 2D 31 30 20 31 36 3A 32 32 |2026-04-10 16:22| 00000010 3A 30 35 20 5B 49 4E 46 4F 5D 20 43 6F 6E 6E 65 |:05 [INFO] Conne| 00000020 63 74 69 6F 6E 20 65 73 74 61 62 6C 69 73 68 65 |ction establishe| 00000030 64 20 74 6F 20 31 39 32 2E 31 36 38 2E 31 2E 31 |d to 192.168.1.1|

Question

During a forensic examination of a Windows workstation, an analyst discovers a file with a .LOG extension. What type of information is typically stored in this file?

Forensic Hint: The hex dump excerpt shows ASCII text containing a timestamp and a status message ("[INFO]"). Consider what kind of file is designed to append textual records sequentially over time.

Expert Analysis

1. What the Evidence Shows

The extracted hex view clearly demonstrates that sync_transfer.LOG is a plain-text file. The contents reveal a structured, chronological entry: a date/time stamp (2026-04-10 16:22:05), an event severity flag ([INFO]), and an activity description ("Connection established to...").

2. Forensic Stage

This falls under the Examination and Analysis phase. The investigator is analyzing filesystem artifacts based on file extensions, magic numbers (file signatures), and raw data carving to reconstruct user activity.

3. Why the Correct Answer is Correct

Option A is correct. A file with a .LOG extension is universally utilized across Windows (and other operating systems) as a sequentially written, plain-text file to record chronological events, system states, errors, or application activities. It is a fundamental artifact for timeline analysis.

4. Why Others are Wrong

B is incorrect: System driver files typically utilize the .SYS extension and consist of compiled, executable binary code, not plain text event records.

C is incorrect: Compressed archive files use extensions like .ZIP, .RAR, or .7z, and contain compressed binary data characterized by specific magic numbers (e.g., PK for ZIP).

D is incorrect: Browser configuration files generally use extensions such as .INI, .JSON, or .XML, or they rely on structured database files like SQLite (e.g., Chrome's preferences or history files).

5. Real-World Forensic Action

Upon discovering a suspect .LOG file, a forensic examiner will extract the file and parse its contents using timeline reconstruction tools (like Plaso/log2timeline) or simple text processors (like grep/findstr). These logs provide critical correlation points that can be cross-referenced with the Windows Registry or modern .EVTX logs to prove malicious execution or data exfiltration.

MINI LESSON: Windows Log Artifacts

  • .LOG Files: Plain-text, legacy, or application-specific logs. Common examples include setupapi.dev.log (for USB tracking) and IIS web server logs.
  • .EVTX Files: The modern Windows XML Event Log format. These are structured binary files found in System32\winevt\Logs (e.g., Security.evtx, System.evtx) and require specific parsers.
  • Signature Verification: Advanced attackers may rename a malicious executable (e.g., malware.exe) to harmless.log. Forensic investigators must always verify the file signature (magic number) rather than relying solely on the file extension.

Ready for the next case?

Explore more CHFI simulations and master digital forensics investigation.

Practice More Scenarios