During incident response, a responder discovers a Windows system where an attacker used Scheduled Tasks for persistence. Which Windows artifact should be examined to recover historical task execution data?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Task Scheduler operational log records task registration, execution, and completion events with timestamps, making it the primary artifact for scheduled task forensics. A is wrong because the Services registry key tracks Windows services, not scheduled tasks.
Full explanation below image
Full Explanation
B is correct because the Task Scheduler operational log records task registration, execution, and completion events with timestamps, making it the primary artifact for scheduled task forensics. A is wrong because the Services registry key tracks Windows services, not scheduled tasks. C is wrong because Prefetch files show that executables were run but do not specifically attribute execution to a scheduled task trigger. D is wrong because the MFT records file metadata but does not record task execution events.