Computer Hacking Forensic Investigator (CHFI) — Question 153

Which of the following file contains the traces of the applications installed, run, or uninstalled from a system?

Answer options

• A. Shortcut Files
• B. Virtual files
• C. Prefetch Files
• D. Image Files

Correct answer: A

Explanation

Shortcut Files store information about applications that have been used on a system, including those that have been installed or uninstalled. The other options do not track application usage in the same way: Virtual files pertain to virtualization, Prefetch Files are related to speeding up application load times, and Image Files are for storing graphical data.