312-49 · Question #489
Smith, an employee of a reputed forensic Investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in hacking of organization DC server. Smi
The correct answer is C. RunMRU key. The RunMRU (Most Recently Used) registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU stores a history of every command typed into the Start -> Run dialog box. UserAssist tracks GUI program launches, MountedDevices records connected storage d
Question
Smith, an employee of a reputed forensic Investigation firm, has been hired by a private organization to investigate a laptop that is suspected to be involved in hacking of organization DC server. Smith wants to find all the values typed into the Run box in the Start menu. Which of the following registry key Smith will check to find the above information?
Options
- AUserAssist Key
- BMountedDevices key
- CRunMRU key
- DTypedURLs key
How the community answered
(33 responses)- A3% (1)
- B3% (1)
- C94% (31)
Explanation
The RunMRU (Most Recently Used) registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU stores a history of every command typed into the Start -> Run dialog box. UserAssist tracks GUI program launches, MountedDevices records connected storage devices, and TypedURLs stores URLs entered directly into Internet Explorer's address bar - none of these capture Run dialog history.
Topics
Community Discussion
No community discussion yet for this question.