CHFI Module 6 Review

Windows Security Accounts Manager (SAM) is a registry file which stores passwords in a Hashed format. SAM file in Windows is located at:

• C:\windows\system32\config\SAM

• C:\windows\system32\Boot\SAM

• C:\windows\system32\drivers\SAM

• C:\windows\system32\con\SAM

You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32.exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor?

• HKEY-LOCAL_ADMIN

• HKEY_CLASSES_ADMIN

• HKEY_USERS

• HKEY_CLASSES_SYSTEM

When collecting evidence from RAM, where do you look for data?

• SAM file

• Data file

• Swap file

• Log file

n General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

• Disaster Recovery

• Data Recovery

• Computer Forensics

• Disaster Recovery

Use the doskey/history command to see previously typed commands

• True

• False

Non-volatile data changes when a system is shut down or unable to power up.

• True

• False

Running the command dir /o:d enables an investigator to examine the time and date of an OS installation.

• True

• False

In Registry Settings you can disable last access.

• True

• False

Microsoft security IDs are available in Windows Registry Editor. The path to access the IDs is:

• HKEY_LOCAL_MACHINE\HARDWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

• HKEY-LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProfileList

Windows 10 comes with Microsoft Edge as a default web browser. You can obtain browsing records, history, cache and cookies through the use of their

• Extendable Storage Engine (ESE) database format

• Extensible Storage Engine (ESE) database format

• Extensive Storage Engine (ESE) database format

• Extended Storage Engine (ESE) database format