EnCE Registry Analysis 4

Question 1

Which registry key stores identifying information about USB mass storage devices that have ever been connected to a Windows system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR contains a subkey per device class with the device's serial number, friendly name, and hardware IDs.

Question 2

Where does Windows store the active time zone configuration that forensic examiners must use when interpreting registry timestamps?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation

Answer

HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation stores the active time zone bias values required to convert UTC timestamps to local system time.

Question 3

Which registry key records the names and first/last connection timestamps of wireless networks a Windows system has joined?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles stores SSID names, profile GUIDs, and DateCreated/DateLastConnected timestamps for each network profile.

Question 4

In EnCase registry analysis, what do the terms 'allocated' and 'unallocated' cells refer to within a hive file?

Accepted Answer

Whether registry cells (keys/values) are active or marked as deleted within the hive binary structure

Answer

Registry hive cells are marked allocated (active) or unallocated (deleted) within the hive; deleted cells may be recoverable by carving the hive binary until overwritten.

Question 5

Which registry key can provide evidence of the last interactive user logon time on a Windows system?

Accepted Answer

HKLM\SAM\SAM\Domains\Account\Users\[RID]

Answer

The SAM hive stores per-user binary records that embed the last interactive logon timestamp along with failed logon count and password change history.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Registry Analysis 4