Free Preparation Discussions
MENU
Eccouncil ECSS Exam - Topic 4 Question 113 Discussion
Topic #: 4
Bob, a forensic investigator, is investigating a live Windows system found at a crime scene. In this process, Bob extracted subkeys containing information such as SAM. Security, and software using an automated tool called FTK Imager.
Which of the following Windows Registry hives' subkeys provide the above information to Bob?
Certainly! Let's break down the question and identify which Windows Registry hives' subkeys contain the requested information.
Windows Registry Hives:
The Windows Registry is a hierarchical database that holds configuration settings and options for both low-level operating system components and running programs.
It includes settings for the kernel, device drivers, services, user interface, and third-party applications.
The registry allows access to counters for system performance profiling.
Registry Hives:
The registry is organized into different hives, each containing keys and values.
Some important hives include:
HKEY_LOCAL_MACHINE (HKLM): Contains system-wide settings.
HKEY_CURRENT_USER (HKCU): Contains settings specific to the currently logged-in user.
HKEY_USERS (HKU): Contains profiles for all users on the system.
HKEY_CLASSES_ROOT (HKCR): Contains file association information.
HKEY_CURRENT_CONFIG (HKCC): Contains information about the current hardware configuration (only in certain Windows versions).
Subkeys Relevant to Bob's Investigation:
Bob is interested in information related toSAM,Security, andsoftware.
Let's see which hives contain these subkeys:
SAM(Security Account Manager):
The SAM hive stores user account information, including usernames, passwords, account types, enabled status, group memberships, and last logon time.
It is crucial for authentication and security.
Located in:HKEY_LOCAL_MACHINESAM
Security:
The Security hive contains security-related information, including access control lists (ACLs), user privileges, and security tokens.
It plays a vital role in enforcing security policies.
Located in:HKEY_LOCAL_MACHINESecurity
Software:
The Software subkey within the HKLM hive contains information related to installed software, configurations, and settings.
It is essential for forensic investigations.
Located in:HKEY_LOCAL_MACHINESoftware
Answer :
The subkeys that provide the requested information to Bob are:
SAM(located inHKEY_LOCAL_MACHINESAM)
Security(located inHKEY_LOCAL_MACHINESecurity)
Sylvia
8 hours agoCarey
6 days agoBulah
11 days agoMaxima
16 days agoLeonora
21 days agoGeoffrey
26 days agoHannah
1 month agoGlory
1 month agoMatilda
1 month agoJoanne
2 months agoMaricela
2 months agoLeatha
2 months agoPolly
2 months agoYuki
2 months agoTalia
3 months agoBen
3 months agoAntonio
3 months agoBenton
3 months agoSusana
2 months ago