312-49V11 · Question #30
Nora, a forensic investigator, is examining the Windows Registry of a compromised system as part of her investigation into a potential insider threat. She wants to determine which folders were most…
The correct answer is A. BagMRU key. According to the CHFI v11 Operating System Forensics objectives, the Windows Registry is a critical source of evidence for reconstructing user activity, particularly in insider threat investigations. One of the most important Registry artifacts for identifying recently accessed…
Question
Nora, a forensic investigator, is examining the Windows Registry of a compromised system as part of her investigation into a potential insider threat. She wants to determine which folders were most recently accessed by the user. After reviewing the Registry, she discovers that a particular Registry key stores information about the folders the user recently accessed, including the folder names and their paths in the file system. Based on her findings, which of the following Registry keys contains this information?
Options
- ABagMRU key
- BMRUListEx key
- CBags key
- DNodeSlot value
How the community answered
(47 responses)- A83% (39)
- B2% (1)
- C11% (5)
- D4% (2)
Explanation
According to the CHFI v11 Operating System Forensics objectives, the Windows Registry is a critical source of evidence for reconstructing user activity, particularly in insider threat investigations. One of the most important Registry artifacts for identifying recently accessed folders is the BagMRU key. The BagMRU key is part of the Windows ShellBags artifact structure and is specifically designed to track folder navigation history. It stores hierarchical information about folders accessed by a user, including folder names, directory paths, and access order relationships. These keys allow forensic investigators to determine which directories a user browsed, even if the folders were accessed via Windows Explorer and later deleted from the system. While the MRUListEx value exists within ShellBag-related keys, it only defines the order of access and does not store the actual folder path or name. The Bags key, on the other hand, stores folder view settings such as icon size, window position, and display preferences--not access history. The NodeSlot value is associated with Jump Lists and application usage tracking rather than directory navigation.
Topics
Community Discussion
No community discussion yet for this question.