QuestionQ58

Data Collection and Sources of Threat Intelligence

Harry, a security professional, was hired to identify details of an attack initiated on a Windows system. During this process, Harry decided to examine logs for currently running applications and information related to applications that had previously been uninstalled or removed for suspicious events.

Which of the following folders on a Windows system stores information about applications run on the system?

  • A C:\Windows\debug
  • B C:\Windows\Book
  • C C:\Windows\Prefetch
  • D C:\subdir
Explanation

The Windows Prefetch folder contains Prefetch files created for executed applications. These artifacts record program-execution-related information and are commonly examined during Windows forensic investigations.

Community Discussion

No comments yet. Be the first to start the discussion!