EnCE Registry Analysis 3

Question 1

What encoding method obfuscates the program paths and GUIDs stored in the UserAssist registry key?

Accepted Answer

ROT13 cipher

Answer

UserAssist program paths are encoded with ROT13, a simple Caesar cipher shifting each letter by 13 positions, which is trivially reversible.

Question 2

Which registry key path stores UserAssist entries that track GUI-launched program executions per user?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Answer

UserAssist is stored per-user under HKCU in the Explorer branch, recording run counts and last execution timestamps for each program launched via the shell.

Question 3

What unique forensic value do Shellbag registry entries provide that other artifacts cannot reliably offer?

Accepted Answer

They preserve evidence that a folder existed and was browsed even after the folder is deleted

Answer

Shellbags retain window size, view preferences, and access history for folders regardless of whether those folders still exist on the filesystem.

Question 4

Where are the primary Shellbag entries located in the registry on Windows Vista and later systems?

Accepted Answer

HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU

Answer

On Vista and later, the primary Shellbag location is HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU.

Question 5

Which registry key records URLs typed directly into the Internet Explorer or legacy Edge address bar?

Accepted Answer

HKCU\Software\Microsoft\Internet Explorer\TypedURLs

Answer

TypedURLs is stored in HKCU under the Internet Explorer branch and records up to 25 URLs manually entered into the address bar.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Registry Analysis 3