312-49V11 · Question #134
Investigator Janet comes across a suspicious Windows registry key during a computer hacking forensic investigation. She believes modifying this key is associated with the recent cyberattack on the…
The correct answer is A. Last Write Time. Windows registry keys store a timestamp known as Last Write Time, indicating the last time the key (or its values) was modified. This is the standard forensic timestamp used to correlate registry changes with incident timelines.
Question
Investigator Janet comes across a suspicious Windows registry key during a computer hacking forensic investigation. She believes modifying this key is associated with the recent cyberattack on the company's servers. In order to confirm this, Janet needs to reference a timestamp embedded inside the registry key. What is the correct name of this timestamp?
Options
- ALast Write Time
- BUser Activity Time
- CSystem Modification Time
- DCurrent System Time
How the community answered
(18 responses)- A83% (15)
- B6% (1)
- D11% (2)
Explanation
Windows registry keys store a timestamp known as Last Write Time, indicating the last time the key (or its values) was modified. This is the standard forensic timestamp used to correlate registry changes with incident timelines.
Topics
Community Discussion
No community discussion yet for this question.