Which data in the Registry can the Registry Viewer translate for the user? (Choose three.)

Question

Options

• Acalculate MD5 hashes of individual keys
• Btranslate the MRUs in chronological order
• Cpresent data stored in null terminated keys
• Dpresent the date and time of each typed URL
• EView Protected Storage System Provider (PSSP) data

• A
  6% (2)
• B
  77% (24)
• D
  16% (5)

Explanation

Registry Viewer (AccessData's forensic tool) is designed to interpret raw Registry data into human-readable formats. It translates MRU (Most Recently Used) lists into chronological order (B), making it easy to reconstruct a user's activity timeline. It also presents data stored in null-terminated strings (C), converting the raw binary format into readable text, and can view Protected Storage System Provider (PSSP) data (E), which holds sensitive artifacts like saved passwords and autocomplete entries that are otherwise obfuscated.

Why the distractors are wrong:

• A is incorrect because calculating MD5 hashes is a file integrity/verification task, not a Registry data translation feature - that belongs to hashing tools, not Registry Viewer.
• D is incorrect because while Typed URLs are stored in the Registry, Registry Viewer does not specifically present a timestamp for each individual typed URL; that granularity isn't a built-in translation feature.

Memory tip: Think of Registry Viewer's strengths as "Order, Readability, and Secrets" - it orders MRUs chronologically, makes raw/null-terminated strings readable, and exposes secret/protected storage data. If a choice sounds like a hashing or timestamping tool function rather than a display/translation function, it's likely a distractor.

No community discussion yet for this question.