An incident responder suspects a Windows system was compromised via a malicious email attachment. Which artifact provides the most direct evidence that an email attachment was opened?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because email client attachment folders contain the opened file, and Windows Recent Items (LNK files) record files that were recently opened including attachments, providing direct evidence linking the opened attachment to subsequent malicious activity. A is wrong because process creation logs show the email client running but do not specifically tie it to an attachment being opened.
Full explanation below image
Full Explanation
B is correct because email client attachment folders contain the opened file, and Windows Recent Items (LNK files) record files that were recently opened including attachments, providing direct evidence linking the opened attachment to subsequent malicious activity. A is wrong because process creation logs show the email client running but do not specifically tie it to an attachment being opened. C is wrong because DNS cache shows domains resolved but does not prove an attachment was opened versus a web link being clicked. D is wrong because pagefile analysis requires memory forensics expertise and provides indirect evidence at best.