SANS 500 Exam (2025/2026) – 100 Verified Questions & Answers | Windows Forensics, Registry, RAM, NTFS

This document is a professionally organized and graded exam preparation guide for the SANS 500: Windows Forensics and Incident Response certification, tailored for the 2025/2026 academic year. It includes 100 exam-style questions with correct, validated answers, focusing on real-world scenarios and forensic challenges across modern Windows operating systems. The questions cover advanced topics in system forensics and incident response, including: Volatile data acquisition and memory forensics Web browser artifacts (Firefox, Edge, Chrome), private browsing, cookies, and session tracking Email investigation through OST/PST analysis and encrypted communication detection Windows registry keys and values relevant to user activity, system configuration, and persistence Shortcut file (.lnk) and prefetch file forensics to track program execution and access patterns Volume Shadow Copies and associated forensic recovery methods NTFS metadata: $MFT, $Logfile, alternate data streams (ADS), Zone.Identifier Cloud storage artifacts (Google Drive, Dropbox), chat apps, and synchronized file logs Timeline creation using ShellBags, UserAssist, MRU, and AppLaunch registry subkeys Forensic analysis using tools like Arsenal Image Mounter, PhotoRec, EDD, esentutl This document is ideal for students and professionals preparing for roles in: Digital Forensics and Incident Response (DFIR) Cybersecurity and Ethical Hacking programs Computer Science with a focus on system security Law enforcement and internal corporate investigations SANS and GIAC certification preparation Its content is structured to bridge technical theory and forensic application, making it perfect for practical labs, classroom review, and certification success. Keywords: SANS 500, Windows forensics, RAM acquisition, volatile data, registry forensics, $MFT, UserAssist, AppLaunch, ShellBags, NTFS artifacts, LNK files, prefetch, Firefox forensics, Zone.Identifier, ADS, esentutl, VSC, Email forensics, pst, ost, PhotoRec, encrypted drives, forensic timeline, DropBox logs, Google Drive cache, forensic tools, AppData analysis, Skype logs