SANS FOR508 ACTUAL EXAM PAPER
2026 QUESTIONS WITH ANSWERS
GRADED A+
◍ PREFETCH.
Answer: Shows what ran, when it ran, how many times. Used for perf
increases. Win10 has compressed .PF
files.C:\Windows\Prefetch\7ZG.EXE-D9AA3A0B.pf Hash is path of EXE
and command line128 File on Win7, 8+ can have 1024Prefetch files can be
carved from unallocated space using blkls and foremostPrefetch can be
disabled via registry.Date created is first executed, modified last executed
◍ PF.
Answer: Command line tool that parses .PF files. Outputs app name and
path, times executed, last run, prefetch MAC timestamps in CSV.
◍ PECmd.
Answer: Similar to PF - prefetch parser tool. Can do entire directory w/ D
option. Output in JSON,CSV,HTML
◍ Prefetchparser.
Answer: Part of volatility framework. Will search memory for prefetch and
parse. Good for finding PF data deleted or removed by attackers.
◍ Under which iOS sub-directory folder would an examiner expect to find
Internet history, caches, keyboards, and Cookies?.
Answer: Library The /private/var/mobile/Library folder (physical
acquisition), Backup Service/mobile/Library (File System acquisition) or
Library folder (Logical acquisition) contains most of the data of interest for
forensic examiners. The Library folder contains a vast amount of folders
including those containing data pertaining to communication, Internet
, history, Preferences, Keyboard, Caches and more. Tools like Physical
Analyzer provide access to all of these folders and database files.Another
location for the Library folder may be the Data/Data/mobile/Library for
physical acquisition.Answer Options:•Health•Library•Applications•Media
◍ ShimCache.
Answer: App compat tool. Tracks last modified date, file path, and if
executed. XP shows last execution time, Server shows executed FLAG.
Located in the registry. XP =
CCS\Control\SessionManager\AppCompatibility\AppCompatCache(96
Entries), Server =
CCS\Control\SessionManager\AppCompatChache\AppCompatCache(1024
Entries)Vista on AppCompatChache reg key doesn't prove execution, but it
is likely.
◍ ShimCacheParser.py.
Answer: parses App Compat Shim cache.
◍ ShimCachemem.
Answer: Volatility plugin that extracts AppCompatCache from memory
images, even items not yet written to disk. Vol.py -f memory
shimcachemem | Less
◍ RecentFileCache.bcf.
Answer: Related to App Compat Cache and contains references to programs
recently copied or downloaded and executed. RecentFileCache is the short
term storage of recent file adds.
c:\Windows\AppCompat\Programs\RecentFileCache.bcf. Small file
managed by ProgramDataUpdater task(12:30AM Nightly).
◍ RF
C. PL.
Answer: parses .BCF and outputs path and exe name.
◍ Amcache.hve.
Answer: replaces RecentFileCache.bcf in Win8/10. Program first run and
, last modification time of key. Includes SHA1 and other program info like
product name and description.
C:\Windows\AppCompat\Programs\Amcache.hve. Registry -
amcache.hve\root\file\<Vol GuiD>\##### = Key name after MFT Entry.
◍ What SQLite data type can be exported in order to be opened with a
compatible program?.
Answer: BLOBLike the name suggests, BLOBs are comprised of binary
data. Embedded files are stored as BLOBs. This data can be exported and
then opened with a compatible program.Answer
Options:•PLIST•TIFE•BLOB•JPEG
◍ What can be concluded from a folder named
"00e456d65498137b76ec5b4137a70821df4afdbf" found in a device's
MobileSync directory?.
Answer: The backup was made prior to fall 2018The backup files from an
iOS device prior to September 2018 changed from the 40 digit alphanumeric
GUID to a format of 8 characters for the ChipID padded with zeros followed
by 16 characters of ECID in hex padded with zeros on the left. Similar to
[Opadding] CHIP-[0padding]ECID. An iPhone XS/XR series phone will
have the Chip ID of 8020 and an iPhone 11 will have a ChipID of
8030.Answer Options:• The folder was created using Samsung Kies• The
device model is an iPhone 11• The backup was for an Android phone• The
backup was made prior to fall 2018
◍ AmcacheParser.
Answer: Parses out amcache.hve sha1,full path,MFT,file size, compile time
◍ Volume Shadow Copies.
Answer: Windows backup of OS or virtual snap shots. Event Logs, Reg
Files, Deleted files. Created at application install, Unsigned driver install,
system updates, System Restore, System Boot(win7,8,10). Stored in System
Volume Information folder.
◍ Vshadowinfo.
Answer: list all shadow snapshots in a disk image - similar to VSSADMIN
, list Shadows. -o switch to point to disk offset in NTFS
◍ vshadowmount.
Answer: tool to mount all VSS images in SIFT wks. Ewfmount PathTo.EO1
/mnt/vss/ -> vshadowmount /mnt/ewf_mount/ewf1 /mnt/vss/ .
◍ Credential Theft Bullets.
Answer: • Managed Service account in 2008R2 and provides frequent
password changes. New version is called Group Managed Service
Accounts.• Win8 removed CredSSP, TsPkg and Wdigest from memory by
default which stopped plaintext password recovery. • Win8 local account
restrictions in place for network and remote interactive systems.• Win8
introduced protected LSASS process(off by default)• Win8 RDP /Restricted
Admin• Win10 Credential Guard isolates hashes and tickets enforced by
hardware. Remote credential guard is updated restricted admin and protects
any account during RDP. Device Guard is application whitelisting.
◍ What is often more of a challenge with mobile forensics than other areas of
forensics?.
Answer: Isolation of devicesThe process of digital forensics is the same as
other forensics sciences, and the process in mobile device forensics closely
follows the same path. In mobile device forensics, however, we also have
the extra challenge of isolation of devices we are working with because they
are designed to communicate with the surrounding mobile network, with
satellites, surrounding wireless networks, and via Bluetooth or other
means.Answer Options:• Identification of evidence• Evidence collection•
Isolation of devices• Analysis and Reporting of Information
◍ Which feature of Gatekeeper password storage on an Android device
combats the use of rainbow tables to crack the device's PIN or lock pattern?.
Answer: TEESalting is a common practice in the Android OS, and is not a
feature specific to Gatekeeper. In earlier versions of the Android operating
system, password hashes were salted using a combination of the MD5 and
SHA-1 hash of the original password and then stored locally in a database.
The salt used was also stored on the device in a separate database. This
2026 QUESTIONS WITH ANSWERS
GRADED A+
◍ PREFETCH.
Answer: Shows what ran, when it ran, how many times. Used for perf
increases. Win10 has compressed .PF
files.C:\Windows\Prefetch\7ZG.EXE-D9AA3A0B.pf Hash is path of EXE
and command line128 File on Win7, 8+ can have 1024Prefetch files can be
carved from unallocated space using blkls and foremostPrefetch can be
disabled via registry.Date created is first executed, modified last executed
◍ PF.
Answer: Command line tool that parses .PF files. Outputs app name and
path, times executed, last run, prefetch MAC timestamps in CSV.
◍ PECmd.
Answer: Similar to PF - prefetch parser tool. Can do entire directory w/ D
option. Output in JSON,CSV,HTML
◍ Prefetchparser.
Answer: Part of volatility framework. Will search memory for prefetch and
parse. Good for finding PF data deleted or removed by attackers.
◍ Under which iOS sub-directory folder would an examiner expect to find
Internet history, caches, keyboards, and Cookies?.
Answer: Library The /private/var/mobile/Library folder (physical
acquisition), Backup Service/mobile/Library (File System acquisition) or
Library folder (Logical acquisition) contains most of the data of interest for
forensic examiners. The Library folder contains a vast amount of folders
including those containing data pertaining to communication, Internet
, history, Preferences, Keyboard, Caches and more. Tools like Physical
Analyzer provide access to all of these folders and database files.Another
location for the Library folder may be the Data/Data/mobile/Library for
physical acquisition.Answer Options:•Health•Library•Applications•Media
◍ ShimCache.
Answer: App compat tool. Tracks last modified date, file path, and if
executed. XP shows last execution time, Server shows executed FLAG.
Located in the registry. XP =
CCS\Control\SessionManager\AppCompatibility\AppCompatCache(96
Entries), Server =
CCS\Control\SessionManager\AppCompatChache\AppCompatCache(1024
Entries)Vista on AppCompatChache reg key doesn't prove execution, but it
is likely.
◍ ShimCacheParser.py.
Answer: parses App Compat Shim cache.
◍ ShimCachemem.
Answer: Volatility plugin that extracts AppCompatCache from memory
images, even items not yet written to disk. Vol.py -f memory
shimcachemem | Less
◍ RecentFileCache.bcf.
Answer: Related to App Compat Cache and contains references to programs
recently copied or downloaded and executed. RecentFileCache is the short
term storage of recent file adds.
c:\Windows\AppCompat\Programs\RecentFileCache.bcf. Small file
managed by ProgramDataUpdater task(12:30AM Nightly).
◍ RF
C. PL.
Answer: parses .BCF and outputs path and exe name.
◍ Amcache.hve.
Answer: replaces RecentFileCache.bcf in Win8/10. Program first run and
, last modification time of key. Includes SHA1 and other program info like
product name and description.
C:\Windows\AppCompat\Programs\Amcache.hve. Registry -
amcache.hve\root\file\<Vol GuiD>\##### = Key name after MFT Entry.
◍ What SQLite data type can be exported in order to be opened with a
compatible program?.
Answer: BLOBLike the name suggests, BLOBs are comprised of binary
data. Embedded files are stored as BLOBs. This data can be exported and
then opened with a compatible program.Answer
Options:•PLIST•TIFE•BLOB•JPEG
◍ What can be concluded from a folder named
"00e456d65498137b76ec5b4137a70821df4afdbf" found in a device's
MobileSync directory?.
Answer: The backup was made prior to fall 2018The backup files from an
iOS device prior to September 2018 changed from the 40 digit alphanumeric
GUID to a format of 8 characters for the ChipID padded with zeros followed
by 16 characters of ECID in hex padded with zeros on the left. Similar to
[Opadding] CHIP-[0padding]ECID. An iPhone XS/XR series phone will
have the Chip ID of 8020 and an iPhone 11 will have a ChipID of
8030.Answer Options:• The folder was created using Samsung Kies• The
device model is an iPhone 11• The backup was for an Android phone• The
backup was made prior to fall 2018
◍ AmcacheParser.
Answer: Parses out amcache.hve sha1,full path,MFT,file size, compile time
◍ Volume Shadow Copies.
Answer: Windows backup of OS or virtual snap shots. Event Logs, Reg
Files, Deleted files. Created at application install, Unsigned driver install,
system updates, System Restore, System Boot(win7,8,10). Stored in System
Volume Information folder.
◍ Vshadowinfo.
Answer: list all shadow snapshots in a disk image - similar to VSSADMIN
, list Shadows. -o switch to point to disk offset in NTFS
◍ vshadowmount.
Answer: tool to mount all VSS images in SIFT wks. Ewfmount PathTo.EO1
/mnt/vss/ -> vshadowmount /mnt/ewf_mount/ewf1 /mnt/vss/ .
◍ Credential Theft Bullets.
Answer: • Managed Service account in 2008R2 and provides frequent
password changes. New version is called Group Managed Service
Accounts.• Win8 removed CredSSP, TsPkg and Wdigest from memory by
default which stopped plaintext password recovery. • Win8 local account
restrictions in place for network and remote interactive systems.• Win8
introduced protected LSASS process(off by default)• Win8 RDP /Restricted
Admin• Win10 Credential Guard isolates hashes and tickets enforced by
hardware. Remote credential guard is updated restricted admin and protects
any account during RDP. Device Guard is application whitelisting.
◍ What is often more of a challenge with mobile forensics than other areas of
forensics?.
Answer: Isolation of devicesThe process of digital forensics is the same as
other forensics sciences, and the process in mobile device forensics closely
follows the same path. In mobile device forensics, however, we also have
the extra challenge of isolation of devices we are working with because they
are designed to communicate with the surrounding mobile network, with
satellites, surrounding wireless networks, and via Bluetooth or other
means.Answer Options:• Identification of evidence• Evidence collection•
Isolation of devices• Analysis and Reporting of Information
◍ Which feature of Gatekeeper password storage on an Android device
combats the use of rainbow tables to crack the device's PIN or lock pattern?.
Answer: TEESalting is a common practice in the Android OS, and is not a
feature specific to Gatekeeper. In earlier versions of the Android operating
system, password hashes were salted using a combination of the MD5 and
SHA-1 hash of the original password and then stored locally in a database.
The salt used was also stored on the device in a separate database. This
