GIAC

GCFE · Question #112

Which Windows artifact stores details about USB devices that were plugged into a system?

The correct answer is B. Registry key: SYSTEM\CurrentControlSet\Enum\USBSTOR. See the full explanation below for the reasoning.

Question

Which Windows artifact stores details about USB devices that were plugged into a system?

Options

A$MFT
BRegistry key: SYSTEM\CurrentControlSet\Enum\USBSTOR
CPrefetch
DShimcache

How the community answered

(20 responses)

A
15% (3)
B
75% (15)
C
5% (1)
D
5% (1)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full GCFE Practice