EC-Council
312-49V9 · Question #302
What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 server the course of its lifetime?
The correct answer is D. review of SIDs in the Registry. Not MD5: MD5 checksums are used as integrity checks User accounts are assigned a unique SID, and the SID are not reused.
Windows Forensics
Question
What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 server the course of its lifetime?
Options
- Aforensic duplication of hard drive
- Banalysis of volatile data
- Ccomparison of MD5 checksums
- Dreview of SIDs in the Registry
How the community answered
(33 responses)- A12% (4)
- B6% (2)
- C6% (2)
- D76% (25)
Explanation
Not MD5: MD5 checksums are used as integrity checks User accounts are assigned a unique SID, and the SID are not reused.
Topics
#Windows Registry#Security Identifier#user account forensics#SID analysis
Community Discussion
No community discussion yet for this question.