Computer Hacking Forensic Investigator (CHFI v10) — Question 45

Which of the following file contains the traces of the applications installed, run, or uninstalled from a system?

Answer options

• A. Shortcut Files
• B. Virtual files
• C. Prefetch Files
• D. Image Files

Correct answer: C

Explanation

The correct answer is C, Prefetch Files, as these files are specifically designed to store information about applications that have been run on the system to speed up their subsequent launches. The other options do not serve this purpose: A (Shortcut Files) merely point to application locations, B (Virtual files) pertain to virtualization, and D (Image Files) are used for storing images rather than application traces.