I85PREP
⌘ K
CCFH study materials
CCFH study resources

CCFH: Operating System and Artifact Forensics

CCFH · Work through your exam, one topic at a time.

All guide sections

Operating System and Artifact Forensics

What this domain tests

This domain tests whether you can answer behavioural questions, such as what ran, what was attached, and who logged on, using operating-system artifacts and their corroboration.

Core rules and concepts

  • Windows registry hives. SAM holds local accounts; SECURITY holds cached credentials and policy; SOFTWARE and SYSTEM hold configuration; NTUSER.DAT and UsrClass.dat hold per-user activity. Load hives in a forensic tool rather than the live registry.
  • Execution evidence. Prefetch shows execution and load counts but can be disabled; Amcache records program inventory and first execution; Shimcache (AppCompatCache) shows file presence and sometimes execution, not proof of it; SRUM records per-application resource use; UserAssist values are ROT13-encoded.
  • User activity. Shellbags show folder navigation, LNK files and Jump Lists show recently opened items, and the Recycle Bin stores original paths.
  • Event logs. Security log: 4624 logons with type codes (2 interactive, 3 network, 10 remote interactive), 4625 failures, 4672 special privileges, 4688 process creation, 7045 service installation. PowerShell 4104 records script blocks; Sysmon adds process and network telemetry.
  • Linux and macOS. Linux: /var/log, wtmp and btmp, bash_history, cron, systemd journal. macOS: unified logs, FSEvents, .DS_Store, quarantine events, and property lists.

Worked example

A question asks whether a credential-dumping tool ran. Shimcache presence alone proves only that the file existed. Prefetch shows execution with a timestamp and load count; Amcache shows the binary was inventoried; SRUM shows it consumed CPU and network; Security 4688 or Sysmon event 1 records the process creation, ideally with a parent process and command line. Three or more independent artifacts pointing to the same time give a defensible conclusion.

Traps that cost marks

  • Treating Shimcache as proof of execution.
  • Forgetting that Prefetch may be disabled on servers or wiped by cleaning tools.
  • Reading UserAssist without ROT13 decoding.
  • Ignoring time-zone differences between registry timestamps and event logs.
  • Assuming a logon type 3 event means a person sat at the machine.