SANS Advanced Incident Response, Threat Hunting, And Digital Forensics (FOR508) Practice Test

The main idea here is that the USN Change Journal on NTFS is a built-in audit log that records every change to files and directories on a volume, creating a chronological record that can be used to reconstruct what happened when. Each entry captures what changed (create, delete, modify, rename, attribute change, etc.), when it happened, and which file or directory was affected, including enough details to map actions across the timeline. Because this journal preserves a sequence of events directly from the file system, it provides a reliable backbone for timeline analysis, even if file timestamps are manipulated or multiple artifacts point to the same event. Prefetch files track program startup behavior, not file-system changes themselves. LSASS memory holds sensitive credentials, not a history of file activity. Bash history is Linux shell activity, not Windows NTFS SAMPLEchanges.