WINART · ~15 minutes
Advanced Windows Artifact Analysis · $MFT + Registry + Timeline
$MFT/$LogFile/$UsnJrnl · registry hives · ShimCache/Amcache · Prefetch · SRUM · ShellBags · VSS. 18 questions, 6 Bloom levels. An advanced framework for the DSET Forensic Investigator track.
How the exam works
- 18 questions · across 6 Bloom levels (Remember → Create)
- Each question has one correct answer · an explanation appears after you answer
- No time tracking · think for as long as you like
- At the end, a 6-axis radar + a program recommendation based on your weakest level
- If you choose to, you can save your result to your account and earn an achievement credential