EnCE Registry Analysis 2

Question 1

Which file path on a Windows system contains the HKEY_LOCAL_MACHINE\SYSTEM registry hive?

Accepted Answer

C:\Windows\System32\config\SYSTEM

Answer

The SYSTEM hive is stored at C:\Windows\System32\config\SYSTEM on all modern Windows installations.

Question 2

What does a 'dirty' registry hive indicate to a forensic examiner?

Accepted Answer

The hive was not properly flushed to disk at last shutdown

Answer

A dirty hive means pending changes were not fully committed to disk; the associated transaction log must be replayed to reconstruct the complete hive state.

Question 3

Which registry value data type stores a 32-bit unsigned integer?

Accepted Answer

REG_DWORD

Answer

REG_DWORD stores a 32-bit (4-byte) integer, while REG_QWORD stores a 64-bit integer.

Question 4

What is the forensic purpose of the .LOG files associated with registry hives (e.g., NTUSER.DAT.LOG)?

Accepted Answer

They journal pending changes for crash recovery before committing to the hive

Answer

Registry transaction logs journal changes before they are committed to the main hive file, enabling recovery of the hive state after a system crash.

Question 5

Which registry hive stores local user account information and password hashes on a Windows system?

Accepted Answer

SAM

Answer

The SAM (Security Account Manager) hive stores local user account credentials, group memberships, and hashed passwords.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Registry Analysis 2