EC-Council
312-49 · Question #302
What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 server the course of its lifetime?
The correct answer is D. review of SIDs in the Registry. Not MD5: MD5 checksums are used as integrity checks User accounts are assigned a unique SID, and the SID are not reused.
Submitted by miguelv· Apr 18, 2026Disk Forensics
Question
What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 server the course of its lifetime?
Options
- Aforensic duplication of hard drive
- Banalysis of volatile data
- Ccomparison of MD5 checksums
- Dreview of SIDs in the Registry
How the community answered
(31 responses)- B6% (2)
- C3% (1)
- D90% (28)
Explanation
Not MD5: MD5 checksums are used as integrity checks User accounts are assigned a unique SID, and the SID are not reused.
Topics
#Windows Forensics#User Accounts#Registry Analysis#SIDs
Community Discussion
No community discussion yet for this question.