EnCE Registry Analysis 5

Question 1

Which forensic technique can recover deleted registry keys from a Windows system where the keys are no longer present in the live hive?

Accepted Answer

Parsing Volume Shadow Copies for earlier versions of the hive file

Answer

Volume Shadow Copies retain point-in-time snapshots of registry hive files, allowing recovery of keys that were deleted before the snapshot was taken.

Question 2

What does it forensically imply when a registry key's LastWrite timestamp predates the system's recorded Windows installation date?

Accepted Answer

The timestamp may reflect anti-forensic timestomping, an incorrect system clock, or a registry import from another machine

Answer

A LastWrite time before the OS installation date is anomalous and may indicate timestomping, clock skew, or imported registry data — all requiring corroborating evidence.

Question 3

In EnCase, which capability is most effective for automating registry artifact extraction across a large collection of forensic images?

Accepted Answer

EnScript programs using the Registry class to programmatically traverse hive structures

Answer

EnScript's Registry class provides a programmatic API to open, enumerate, and extract specific keys and values from hives, enabling scalable automation across many images.

Question 4

What forensic evidence does the HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU key provide?

Accepted Answer

Commands typed into the Windows Run dialog box (Win+R)

Answer

RunMRU records the most recently used commands entered into the Windows Run dialog, revealing programs or paths the user manually executed.

Question 5

Which registry key records the last folder path accessed via a Windows common Open/Save file dialog?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU

Answer

ComDlg32's LastVisitedPidlMRU and OpenSavePidlMRU in HKCU record which applications used file dialogs and which folder paths were last visited, revealing file access behavior.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Registry Analysis 5