GCFA · Question #72
Adam works as a professional Computer Hacking Forensic Investigator. He has been assigned with the project of investigating an iPod, which is suspected to contain some explicit material. Adam wants to
The correct answer is A. HKEY_LOCAL_MACHINE\System\CurrentControlset\Control\StorageDevicePolicies. Windows XP SP2 includes a registry key that enforces write protection on removable storage devices, allowing forensic investigators to connect suspect media in read-only mode without altering evidence. The correct and complete registry path is HKEY_LOCAL_MACHINE\System\CurrentCon
Question
Adam works as a professional Computer Hacking Forensic Investigator. He has been assigned with the project of investigating an iPod, which is suspected to contain some explicit material. Adam wants to connect the compromised iPod to his system, which is running on Windows XP (SP2) operating system. He doubts that connecting the iPod with his computer may change some evidences and settings in the iPod. He wants to set the iPod to read-only mode. This can be done by changing the registry key within the Windows XP (SP2) operating system. Which of the following registry keys will Adam change to accomplish the task?
Options
- AHKEY_LOCAL_MACHINE\System\CurrentControlset\Control\StorageDevicePolicies
- BHKEY_LOCAL_MACHINE\CurrentControlset\Control\StorageDevicePolicies
- CHKEY_LOCAL_MACHINE\System\CurrentControlset\StorageDevicePolicies
- DHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
How the community answered
(67 responses)- A70% (47)
- B18% (12)
- C3% (2)
- D9% (6)
Why each option
Windows XP SP2 includes a registry key that enforces write protection on removable storage devices, allowing forensic investigators to connect suspect media in read-only mode without altering evidence. The correct and complete registry path is HKEY_LOCAL_MACHINE\System\CurrentControlset\Control\StorageDevicePolicies.
The registry key HKEY_LOCAL_MACHINE\System\CurrentControlset\Control\StorageDevicePolicies contains the WriteProtect DWORD value which, when set to 1, enforces read-only mode on all connected removable storage devices including iPods in Windows XP SP2. This is the fully qualified and correct path that Windows uses to apply storage device write protection policies, preventing Adam's system from writing to or modifying any data on the connected iPod during forensic examination.
This path omits the required 'System' subkey between HKEY_LOCAL_MACHINE and CurrentControlset, making it an invalid registry path that does not exist in Windows XP.
This path omits the required 'Control' subkey between CurrentControlset and StorageDevicePolicies, making it an invalid key that Windows does not recognize for storage write protection.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion is a general Windows installation configuration path and contains no settings related to storage device write protection.
Concept tested: Windows registry key for removable storage write protection
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/backup-and-storage/cannot-format-usb-flash-drive
Topics
Community Discussion
No community discussion yet for this question.