You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32.exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor?

When collecting evidence from RAM, where do you look for data?

n General, __________________ Involves the investigation of data that can be retrieved from the hard disk or other disks of a computer by applying scientific methods to retrieve the data.

Use the doskey/history command to see previously typed commands

Non-volatile data changes when a system is shut down or unable to power up.

Running the command dir /o:d enables an investigator to examine the time and date of an OS installation.

In Registry Settings you can disable last access.

Microsoft security IDs are available in Windows Registry Editor. The path to access the IDs is:

Windows 10 comes with Microsoft Edge as a default web browser. You can obtain browsing records, history, cache and cookies through the use of their

Slack space refers to the portions of hard drive which may contain data either from a previously deleted file or unused by the currently allocated file.

The NTFS feature that helps to store metadata related to the location of a specific file is known as

An EProcess block is a data structure in which various attributes of the process, as well as pointers to a number of other attributes and data structures relating to the process are maintained.

Lsproc.pl lists processes and locates processes. It takes a single argument, the path, and name to a RAM dump file. Its output will be shown in six columns.

lspd.pl is a command-line Perl script that relies on the output of lsproc.pl to obtain its information.

lspi.pl will reassemble a file even if the memory pages are marked as invalid and are no longer located in memory.

regedit and regedt32 are both GUI registry editors

There are 5 critical hives in the Windows registry that play a critical role in the functioning of the system.

Volume shadow copy is a Windows feature which creates and maintains snapshots of the disk volumes.

Registry keys that track a user's activities can be found in the _______ file

MZCookiesView displays the details of all cookies stored inside the cookies file.

Metadata is data about data. It describes various characteristics about data but cannot tell you who accessed it.

In file systems MAC stands for modified, accessed, and created.

The Registry key which maintains the event log configuration is the ________

Investigators cannot use commands in Linux to gather necessary information.

In Linux, the command "history" lists the Bash's log of the typed commands.

Windows uses an IPConfig command and Linux/MAC used an IFConfig command to view network interfaces.

You use the Task Manager command to investigate processes running on a system.

You can get more information about a suspicious process by dumping the used memory.

In a live response, the forensic investigators should collect which data first?