Source: Juni_2026_Exams/Advance_Forensics/notes/10-exam-question-patterns.md

❓ Exam Question Patterns

Generic Disk-Forensics Questions and Strategies

This file predates the uploaded malware-analysis lectures and verified 2025 exam. Treat it as supplemental disk-forensics practice, not as a prediction of the June 2026 malware-analysis exam. Use notes/00-focus-points.md and solutions/exam-2025-verified-walkthrough.md for source-backed priorities.

Pattern 1: System Ownership & Installation

Question Type

"Who is the registered owner of this computer?"
"When was Windows installed?"
"What is the computer name?"
"What Windows version is installed?"

Answer Strategy

Answer Format

Question: "Who owns this computer and when was it installed?"

Answer:
1. Registered Owner: John Doe
2. Installation Date: 2020-12-31 12:00 UTC
3. Windows Version: Windows 10 Pro
4. Computer Name: WORKSTATION-01

Evidence:
├─ SOFTWARE hive: RegisteredOwner = "John Doe"
├─ SOFTWARE hive: InstallDate = 1577836800 (converted with DCode)
├─ SOFTWARE hive: ProductName = "Windows 10 Pro"
└─ SYSTEM hive: ComputerName = "WORKSTATION-01"

Pattern 2: User Activity & Recent Files

Question Type

"What files did the user recently open?"
"When was this file accessed?"
"What programs did the user execute?"
"What was the last document opened?"

Answer Strategy

Answer Format

Question: "Provide a timeline of user activity"

Answer:
Recently opened files (from RecentDocs registry):
├─ 2021-08-10 14:30 UTC - financial_report.xlsx
├─ 2021-08-10 14:35 UTC - salary_data.csv
└─ 2021-08-10 14:40 UTC - employee_info.txt

Recently executed programs (from UserAssist):
├─ 2021-08-10 14:25 UTC - Chrome.exe (3 times)
├─ 2021-08-10 14:30 UTC - Excel.exe (1 time)
└─ 2021-08-10 14:45 UTC - cmd.exe (1 time)

Evidence:
├─ LNK files in C:\Users\John\AppData\Roaming\Microsoft\Windows\Recent\
└─ NTUSER.DAT registry hive

Pattern 3: System Shutdown & Timeline

Question Type

"When was the computer last shut down?"
"What was the last user activity?"
"Create a timeline of events"

Answer Strategy

1. Get ShutdownTime from SYSTEM hive
2. Convert with DCode
3. Cross-reference with other timestamps
4. Create chronological list

Answer Format

Question: "When was the system shut down and what was happening?"

Answer:
Last Shutdown: 2021-08-10 18:45:32 UTC
Last User Activity: 2021-08-10 18:30 UTC (file access)

Timeline:
2021-08-01 10:00 ← Windows installed
2021-08-05 15:30 ← Suspicious file downloaded
2021-08-10 14:30 ← Malware executed
2021-08-10 18:30 ← User last active
2021-08-10 18:45 ← System shut down

Evidence:
├─ ShutdownTime: SYSTEM hive (converted with DCode)
├─ UserAssist: NTUSER.DAT (timestamps of execution)
└─ File timestamps: MFT Explorer

Pattern 4: Persistence & Malware

Question Type

"Is there evidence of malware persistence?"
"What programs auto-start?"
"Find the persistence mechanism"
"Explain how the malware survives reboot"

Answer Strategy

1. Check Run keys in registry
2. Identify suspicious entries
3. Verify file exists on system
4. Note timestamps
5. Explain impact

Answer Format

Question: "Is there evidence of malware persistence?"

Answer: YES

Persistence Mechanism:
Registry Location: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
Entry Name: "Windows Update Service"
Executable Path: C:\Windows\Temp\malware.exe

Evidence of Malware:
├─ Wrong location (Temp instead of System32)
├─ Suspicious name (mimics Windows Update)
├─ Executable in Temp folder (red flag)
└─ Runs on every user login (persistence)

Impact:
└─ After each restart, malware automatically executes with user privileges

Pattern 5: Deleted Files & Recovery

Question Type

"Find the deleted file 'malware.exe'"
"What was the original location of the deleted file?"
"When was this file deleted?"
"Recover information about deleted files"

Answer Strategy

1. Load $MFT in MFT Explorer
2. Search for deleted files
3. Use "Full Path" column for location
4. Check parent directory reference
5. Note timestamps

Answer Format

Question: "Find all deleted executable files"

Answer:
Deleted .exe Files Found:

File 1: malware.exe
├─ Original Location: C:\Users\John\AppData\Local\Temp
├─ File Size: 245 KB
├─ Created: 2021-08-09 14:30 UTC
├─ Modified: 2021-08-09 14:42 UTC
└─ Status: DELETED (MFT entry marked as deleted)

File 2: backdoor.exe
├─ Original Location: C:\Windows\Temp
├─ File Size: 187 KB
├─ Created: 2021-08-08 10:00 UTC
└─ Status: DELETED

Evidence:
└─ MFT Explorer analysis of $MFT file

Pattern 6: User Accounts & Access

Question Type

"List all non-system users"
"When did this user last log in?"
"Which users have administrator privileges?"
"What are the user accounts on this system?"

Answer Strategy

1. Open SAM hive
2. Navigate to SAM\Domains\Account\Users
3. Identify RIDs (500+ = regular users, <1000 = system)
4. Check login timestamps

Answer Format

Question: "List all non-system user accounts"

Answer:
Non-System Users:
1. Administrator (RID 500)
   └─ Last Login: 2021-08-10 08:00 UTC

2. John Doe (RID 1000)
   └─ Last Login: 2021-08-10 18:30 UTC

3. Guest (RID 501)
   └─ Status: Disabled

Evidence:
└─ SAM hive: Domains\Account\Users registry entries

Pattern 7: Suspicious Files

Question Type

"Find any suspicious programs"
"Are there any executables in Temp?"
"What programs are in the Downloads folder?"
"Identify unauthorized software"

Answer Strategy

1. Search for .exe files in suspicious locations
2. Check file creation/modification times
3. Verify against known programs
4. Note file size and location

Answer Format

Question: "Find all executables in Temp folders"

Answer:
Suspicious Executables:

1. Malware.exe
   └─ Location: C:\Windows\Temp\
   └─ Created: 2021-08-09 14:30 UTC
   └─ Size: 245 KB

2. SystemUpdate.exe
   └─ Location: C:\Users\John\AppData\Local\Temp\
   └─ Created: 2021-08-08 10:00 UTC
   └─ Size: 187 KB

Evidence:
├─ FTK Imager file search
├─ File properties from MFT
└─ Timestamps from $MFT

🎯 General Answer Strategy

For ANY Exam Question

1. IDENTIFY THE TOOL
   └─ What tool do I need?
      ├─ Registry data? → Registry Explorer
      ├─ Deleted files? → MFT Explorer
      ├─ File access? → LNK Analyzer
      ├─ Timestamps? → DCode
      └─ Everything? → FTK Imager first

2. LOCATE THE DATA
   └─ Where is this information?
      ├─ Which hive? (SOFTWARE, SYSTEM, SAM, NTUSER.DAT)
      ├─ Which folder? (Windows\System32\, Temp\, AppData\)
      └─ Which file? ($MFT, .lnk, etc.)

3. EXTRACT THE EVIDENCE
   └─ How do I get to the answer?
      ├─ Extract registry hive from forensic image
      ├─ Open in appropriate tool
      ├─ Navigate to correct path
      ├─ Copy/document findings

4. INTERPRET THE DATA
   └─ What does this mean?
      ├─ Is it normal or suspicious?
      ├─ Do I need to convert format? (DCode for timestamps)
      ├─ Cross-reference with other artifacts?
      └─ What's the full story?

5. WRITE THE ANSWER
   └─ Use this format:
      ├─ Answer the specific question
      ├─ Provide evidence source
      ├─ Show tool/path used
      ├─ Timestamps if relevant
      └─ Be concise but complete

⚠️ Common Answer Mistakes

❌ Mistake 1: Missing Evidence

Wrong: "The file was deleted"
Right: "The file malware.exe was deleted (found in MFT at C:\Temp\...)"

❌ Mistake 2: Wrong Timestamps

Wrong: "Deleted on 2021-08-10"
Right: "Deleted on 2021-08-10 14:30 UTC (based on MFT Changed timestamp)"

❌ Mistake 3: No Tool Mentioned

Wrong: "The owner is John Doe"
Right: "The registered owner is John Doe (found in SOFTWARE hive, RegisteredOwner value)"

❌ Mistake 4: Unverified Claims

Wrong: "Malware was executed"
Right: "Malware.exe exists at C:\Temp\malware.exe with created timestamp 2021-08-10, found in Run registry key"

💡 Pro Tips

Tip 1: Always Cite Your Evidence

EVERY answer should reference:
├─ Tool used
├─ Registry path OR folder location
├─ Specific values/files found
└─ Timestamp if relevant

Tip 2: Use Consistent Format

Keep all answers structured:
1. Direct answer to question
2. Evidence source
3. Relevant timestamps
4. Conclusion

Tip 3: Double-Check Timestamps

Always verify:
├─ Are they converted to readable format?
├─ UTC or local time specified?
└─ Do they make logical sense?

📝 Practice Exam

Sample Questions:
1. Who is the registered owner?
2. When was Windows installed?
3. What programs did the user recently open?
4. Is there evidence of persistence?
5. Find all deleted files
6. When was the system shut down?
7. What are all user accounts?
8. Find suspicious executables
9. Create a timeline of events
10. Was the system compromised? Why?

Last Updated: June 15, 2026