SANS 500 UPDATED ACTUAL ANSWERS AND
QUESTIONS SET A+
✔✔WordWheelQuery - ✔✔Records the historical searches for programs and files on the
machine that are entered into the Start menu or the Explorer folder.
✔✔WPDNSE Folder - ✔✔Maintains a copy of the file that was opened from a MTP
device. Folder is temporary and does not survive reboot. For each folder on the MTP
device where a file is opened from, a corresponding folder is created in the directory.
✔✔WLAN-AutoConfig Log - ✔✔Stores events related to wireless network access. It
contains a wealth of information about each attempted connection to a wireless access
point. Can help identify systems that could have been targeted by a rogue access point
or geolocate where that access point might be.
✔✔Local folder - ✔✔This is where the IE web browser history and cache
information can be found.
✔✔Geolocation - ✔✔Geolocation tracking can be utilized in the case of email
origination, smartphone pictures, WiFi, MAC / SSIDs, and historical networks.
✔✔Chrome Cache - ✔✔Resembles that used by Firefox. Consists of at least five files,
including one index and four data files. If one of those files is corrupt or missing, the
whole cache is recreated. A tool can be used to rebuild the webpage.
✔✔Chrome Cookies - ✔✔Cookies are saved longer than history information and are not
as frequently deleted by users. Chrome, like Firefox, collects all cookies into a single
SQLite database.
✔✔Chrome History - ✔✔Primary history file is a SQLite file called History. Browser
history is stored in this file for 90 days and should be considered the browser's "online"
history storage. Stores information such as download history, auto-complete
, information, and Segments. Stores the most metadata for websites visited out of all the
browsers
✔✔Chrome Preferences - ✔✔JSON file that is constantly updated by the browser and
contains thousands of entries with details for user actions and behavior. Some of the
more important preferences are the previously cleared artifacts, connected network
names, last saved location, last opened from location, zoom levels, and sync data.
✔✔Chrome Profiles - ✔✔Chrome allows you to create multiple profiles. Each profile
maintains its own set of Chrome databases. Profiles are tied to a name or email that
can be found in the Preferences file. "Default" is the standard profile.
✔✔Chrome Session Recovery - ✔✔Four SNSS database files comprise session / tab
recovery. They record tab contents and history.
✔✔Chrome Sync - ✔✔Chrome attempts to turn on synchronization by default. Artifacts
are immediately collected and synced via cloud storage. Artifacts can be copied to
remote systems, even if Chrome is not currently running. The full 90 days of history
information is synced between Chrome instances. Chrome Preferences file should be
reviewed to determine if sync is enabled.
✔✔Cloud Metadata - ✔✔File names and extensions are obvious metadata, but in
addition to that, it is possible to gather created and modified times, file size,
cryptographic hashes, and full path information.
✔✔Tor Browser - ✔✔Alternative browser based off of Firefox that basically makes sure
all browsing activity is done in Private mode. Host based browser artifact analysis is
largely accomplished through memory analysis. To show tor execution, you rely on OS
artifacts like Prefetch and UserAssist.
✔✔Deleted Browser Data - ✔✔Deleted entries can be recovered from SQLite and ESE
databases with the right tools. Data from the file may also still be stored as fragments in
filesystem unallocated space, where it can be discovered with keyword searches.
✔✔Deleted Browser - ✔✔This is a best-case scenario. In Chrome and Firefox, the
databases containing user artifacts are not removed and exist in their original locations
under the user profile and can be forensically analyzed as normal.
✔✔Deleted Files - ✔✔If a file is deleted, the contents are not overwritten immediately.
File carving can recover intact files from memory or unallocated space. This is probably
the most well known method, but most often it is limited to metadata layer extraction.
Data stream carving works the same way, but pulls small fragments from the file, not
the whole file.
QUESTIONS SET A+
✔✔WordWheelQuery - ✔✔Records the historical searches for programs and files on the
machine that are entered into the Start menu or the Explorer folder.
✔✔WPDNSE Folder - ✔✔Maintains a copy of the file that was opened from a MTP
device. Folder is temporary and does not survive reboot. For each folder on the MTP
device where a file is opened from, a corresponding folder is created in the directory.
✔✔WLAN-AutoConfig Log - ✔✔Stores events related to wireless network access. It
contains a wealth of information about each attempted connection to a wireless access
point. Can help identify systems that could have been targeted by a rogue access point
or geolocate where that access point might be.
✔✔Local folder - ✔✔This is where the IE web browser history and cache
information can be found.
✔✔Geolocation - ✔✔Geolocation tracking can be utilized in the case of email
origination, smartphone pictures, WiFi, MAC / SSIDs, and historical networks.
✔✔Chrome Cache - ✔✔Resembles that used by Firefox. Consists of at least five files,
including one index and four data files. If one of those files is corrupt or missing, the
whole cache is recreated. A tool can be used to rebuild the webpage.
✔✔Chrome Cookies - ✔✔Cookies are saved longer than history information and are not
as frequently deleted by users. Chrome, like Firefox, collects all cookies into a single
SQLite database.
✔✔Chrome History - ✔✔Primary history file is a SQLite file called History. Browser
history is stored in this file for 90 days and should be considered the browser's "online"
history storage. Stores information such as download history, auto-complete
, information, and Segments. Stores the most metadata for websites visited out of all the
browsers
✔✔Chrome Preferences - ✔✔JSON file that is constantly updated by the browser and
contains thousands of entries with details for user actions and behavior. Some of the
more important preferences are the previously cleared artifacts, connected network
names, last saved location, last opened from location, zoom levels, and sync data.
✔✔Chrome Profiles - ✔✔Chrome allows you to create multiple profiles. Each profile
maintains its own set of Chrome databases. Profiles are tied to a name or email that
can be found in the Preferences file. "Default" is the standard profile.
✔✔Chrome Session Recovery - ✔✔Four SNSS database files comprise session / tab
recovery. They record tab contents and history.
✔✔Chrome Sync - ✔✔Chrome attempts to turn on synchronization by default. Artifacts
are immediately collected and synced via cloud storage. Artifacts can be copied to
remote systems, even if Chrome is not currently running. The full 90 days of history
information is synced between Chrome instances. Chrome Preferences file should be
reviewed to determine if sync is enabled.
✔✔Cloud Metadata - ✔✔File names and extensions are obvious metadata, but in
addition to that, it is possible to gather created and modified times, file size,
cryptographic hashes, and full path information.
✔✔Tor Browser - ✔✔Alternative browser based off of Firefox that basically makes sure
all browsing activity is done in Private mode. Host based browser artifact analysis is
largely accomplished through memory analysis. To show tor execution, you rely on OS
artifacts like Prefetch and UserAssist.
✔✔Deleted Browser Data - ✔✔Deleted entries can be recovered from SQLite and ESE
databases with the right tools. Data from the file may also still be stored as fragments in
filesystem unallocated space, where it can be discovered with keyword searches.
✔✔Deleted Browser - ✔✔This is a best-case scenario. In Chrome and Firefox, the
databases containing user artifacts are not removed and exist in their original locations
under the user profile and can be forensically analyzed as normal.
✔✔Deleted Files - ✔✔If a file is deleted, the contents are not overwritten immediately.
File carving can recover intact files from memory or unallocated space. This is probably
the most well known method, but most often it is limited to metadata layer extraction.
Data stream carving works the same way, but pulls small fragments from the file, not
the whole file.
