RP L07 Windows Registry 5Q

The Windows Registry is best described as:

• A collection of user documents and media files

• A hierarchical database that stores system and application settings

• A temporary storage area for Windows processes

• A repository for antivirus logs

Which of the following hives contains information about the currently logged-in user?

• HKEY_LOCAL_MACHINE

• HKEY_CURRENT_USER

• HKEY_CLASSES_ROOT

• HKEY_USERS

Investigators often analyze the Windows Registry to:

• View system clock speed

• Recover evidence of user activity such as recently accessed files and USB usage

• Monitor CPU temperature

• Delete unwanted startup programs

Which Registry hive stores information about hardware configuration?

• HKEY_CURRENT_USER

• HKEY_CLASSES_ROOT

• HKEY_LOCAL_MACHINE

• HKEY_CURRENT_CONFIG

In digital forensics, why is the Windows Registry a valuable source of evidence?

• It permanently stores all network traffic

• It records system, user, and software activities useful for investigations

• It encrypts all user passwords

• It blocks malware from running

Which of the following is true about reconstructing events?

• It contains raw images of disk partitions

• It automatically encrypts all user credentials