stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
ADFC - Review 02 Flashcards | StudBud
Explore
/
ADFC - Review 02
ADFC - Review 02
11 terms
·
StudBud Administration
·
19 plays
Review of RAM and Windows Registry concepts
Flashcards
11 cards
F
Practice quiz
P
Host live
L
Questions
11
Answers
1
Which item is
NOT
a top level registry hive?
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_WINDOWS
2
What artifacts of value could be contained in a forensic acquisition of RAM?
Network connectivity
Running Processes
Decrypted data
All of the above
3
What registry data type contains
binary
data?
REG_BINARY
REG_BINARY
REG_BINARY
I'm not sure - but I think it's REG_BINARY
4
Which registry artifacts
only
exist in RAM?
HKEY_CURRENT_CONFIG
SAM
SOFTWARE
NTUSER.DAT
5
Which system artifact is
most
volatile?
CPU cache
Remote logs
Memory
Sequential tape backups
6
Which artifacts of forensic value can be recovered from the Windows Registry?
Installed applications
Most Recently Used files and folders
Time Zone settings
All of the above
7
Which
system
file
, stored on the system drive, will contain remnants of RAM?
pagefile.sys
HKEY_LOCAL_MACHINE
memory.mem
RAM.exe
8
Which registry file contains user specific data?
NTUSER.DAT
SYSTEM
SAM
HKEY_LOCAL_MACHINE
9
How is the
live
Registry accessed?
Registry Explorer
FTK Imager
regedit
by feeding it
10
Which artifact is NOT a Windows registry file?
SAM
SECURITY
SOFTWARE
REGISTRY.DAT
11
What
system file
of evidentiary value is created when the system goes to "sleep"?
RAM.exe
pagefile.sys
hiberfil.sys
sleep.txt
