EnCE Registry Analysis 4 — Questions and Answers
Question 1: Which registry key stores identifying information about USB mass storage devices that have ever been connected to a Windows system?
- HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)
- HKLM\SOFTWARE\Microsoft\Windows\USB\DeviceHistory
- HKCU\Software\Microsoft\Windows\CurrentVersion\USB
- HKLM\SYSTEM\CurrentControlSet\Control\USB\StorageDevices
Correct answer: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR contains a subkey per device class with the device's serial number, friendly name, and hardware IDs.
Question 2: Where does Windows store the active time zone configuration that forensic examiners must use when interpreting registry timestamps?
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime
- HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation (Correct answer)
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Time Zones
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time
Correct answer: HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation
HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation stores the active time zone bias values required to convert UTC timestamps to local system time.
Question 3: Which registry key records the names and first/last connection timestamps of wireless networks a Windows system has joined?
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles (Correct answer)
- HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\Profiles
- HKCU\Software\Microsoft\Windows\CurrentVersion\WiFi\History
- HKLM\SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces
Correct answer: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles stores SSID names, profile GUIDs, and DateCreated/DateLastConnected timestamps for each network profile.
Question 4: In EnCase registry analysis, what do the terms 'allocated' and 'unallocated' cells refer to within a hive file?
- Whether the hive file itself resides in allocated or free disk space
- Whether registry cells (keys/values) are active or marked as deleted within the hive binary structure (Correct answer)
- Whether the hive has been loaded into memory by the operating system
- Whether the hive is protected by Windows File Protection from modification
Correct answer: Whether registry cells (keys/values) are active or marked as deleted within the hive binary structure
Registry hive cells are marked allocated (active) or unallocated (deleted) within the hive; deleted cells may be recoverable by carving the hive binary until overwritten.
Question 5: Which registry key can provide evidence of the last interactive user logon time on a Windows system?
- HKLM\SAM\SAM\Domains\Account\Users\[RID] (Correct answer)
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\LastLogin
- HKLM\SECURITY\Policy\Accounts\[SID]\LastLogin
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
Correct answer: HKLM\SAM\SAM\Domains\Account\Users\[RID]
The SAM hive stores per-user binary records that embed the last interactive logon timestamp along with failed logon count and password change history.
Question 6: What forensic artifact is found at HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName?
- The Windows domain name the computer is joined to
- The hostname of the Windows system (Correct answer)
- The NetBIOS name registered with WINS servers
- The computer's fully qualified domain name (FQDN)
Correct answer: The hostname of the Windows system
This registry key stores the current computer name (hostname), which is critical for confirming the identity of the machine that produced the evidence.
Question 7: When reviewing HKLM\SYSTEM\CurrentControlSet\Services, what forensically significant evidence can an examiner identify?
- Installed software license keys and activation records
- Malicious services or drivers configured to load at startup with their executable image paths (Correct answer)
- A chronological history of all commands run via the command prompt
- The complete list of scheduled tasks configured on the system
Correct answer: Malicious services or drivers configured to load at startup with their executable image paths
The Services key registers all Windows services and kernel drivers including malicious ones, exposing their binary image path, start type, and description.
EnCE Registry Analysis 4
Which registry key stores identifying information about USB mass storage devices that have ever been connected to a Windows system?