EnCE Registry Analysis 2 — Questions and Answers
Question 1: Which file path on a Windows system contains the HKEY_LOCAL_MACHINE\SYSTEM registry hive?
- C:\Windows\System32\config\SYSTEM (Correct answer)
- C:\Windows\Registry\SYSTEM.dat
- C:\Users\Default\SYSTEM.reg
- C:\Windows\SysWOW64\config\SYSTEM
Correct answer: C:\Windows\System32\config\SYSTEM
The SYSTEM hive is stored at C:\Windows\System32\config\SYSTEM on all modern Windows installations.
Question 2: What does a 'dirty' registry hive indicate to a forensic examiner?
- The hive was encrypted by ransomware before acquisition
- The hive was not properly flushed to disk at last shutdown (Correct answer)
- The hive contains keys intentionally corrupted by the user
- The hive was modified by a registry cleaner tool
Correct answer: The hive was not properly flushed to disk at last shutdown
A dirty hive means pending changes were not fully committed to disk; the associated transaction log must be replayed to reconstruct the complete hive state.
Question 3: Which registry value data type stores a 32-bit unsigned integer?
- REG_SZ
- REG_QWORD
- REG_DWORD (Correct answer)
- REG_BINARY
Correct answer: REG_DWORD
REG_DWORD stores a 32-bit (4-byte) integer, while REG_QWORD stores a 64-bit integer.
Question 4: What is the forensic purpose of the .LOG files associated with registry hives (e.g., NTUSER.DAT.LOG)?
- They store a complete audit trail of all registry reads
- They journal pending changes for crash recovery before committing to the hive (Correct answer)
- They maintain historical snapshots of registry state over time
- They synchronize registry data between user accounts on the same machine
Correct answer: They journal pending changes for crash recovery before committing to the hive
Registry transaction logs journal changes before they are committed to the main hive file, enabling recovery of the hive state after a system crash.
Question 5: Which registry hive stores local user account information and password hashes on a Windows system?
- SECURITY
- SOFTWARE
- SAM (Correct answer)
- NTUSER.DAT
Correct answer: SAM
The SAM (Security Account Manager) hive stores local user account credentials, group memberships, and hashed passwords.
Question 6: Which registry key path contains the Windows installation date stored as a Unix epoch timestamp?
- HKLM\SYSTEM\CurrentControlSet\Control\Session Manager
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion (Correct answer)
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
- HKCU\Software\Microsoft\Windows NT\CurrentVersion
Correct answer: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion contains InstallDate (Unix timestamp), RegisteredOwner, ProductName, and build information.
Question 7: When examining a Windows registry key in EnCase, which timestamp metadata is available per key?
- Created, Modified, and Accessed timestamps
- Only the LastWrite (modified) timestamp (Correct answer)
- Created and LastWrite timestamps only
- LastRead and LastWrite timestamps
Correct answer: Only the LastWrite (modified) timestamp
Windows registry keys store only a LastWrite timestamp; there is no separate created or accessed timestamp in the registry binary structure.
EnCE Registry Analysis 2
Which file path on a Windows system contains the HKEY_LOCAL_MACHINE\SYSTEM registry hive?