nerdexam
GIAC

GCFA · Question #283

Which of the following registry hives stores information about the file extensions that are mapped to their corresponding applications?

The correct answer is C. HKEY_CLASSES_ROOT. HKEY_CLASSES_ROOT is the Windows registry hive specifically dedicated to mapping file extensions to their registered applications and storing COM/OLE class registrations.

File System & Registry Forensics

Question

Which of the following registry hives stores information about the file extensions that are mapped to their corresponding applications?

Options

  • AHKEY_CURRENT_USER
  • BHKEY_USERS
  • CHKEY_CLASSES_ROOT
  • DHKEY_LOCAL_MACHINE

How the community answered

(57 responses)
  • A
    5% (3)
  • B
    7% (4)
  • C
    72% (41)
  • D
    16% (9)

Why each option

HKEY_CLASSES_ROOT is the Windows registry hive specifically dedicated to mapping file extensions to their registered applications and storing COM/OLE class registrations.

AHKEY_CURRENT_USER

HKEY_CURRENT_USER stores configuration settings and preferences scoped to the currently logged-in user profile, not system-wide file extension associations.

BHKEY_USERS

HKEY_USERS is a container hive that holds the root of all loaded user profile hives on the system, not file type or application mapping data.

CHKEY_CLASSES_ROOTCorrect

HKEY_CLASSES_ROOT (HKCR) is a merged view of HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes, and it is the canonical location where Windows stores file extension-to-application mappings (e.g., .docx to Word) as well as ProgIDs and COM object registrations used by the shell to open or act on files.

DHKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE stores system-wide hardware configuration, installed software keys, and security settings, but file extension mappings are specifically organized and accessed through HKEY_CLASSES_ROOT.

Concept tested: Windows registry HKEY_CLASSES_ROOT file type associations

Source: https://learn.microsoft.com/en-us/windows/win32/sysinfo/hkey-classes-root-key

Topics

#HKEY_CLASSES_ROOT#registry hives#file extensions#Windows registry

Community Discussion

No community discussion yet for this question.

Full GCFA Practice