GIAC
GCFE · Question #112
GCFE Question #112: Real Exam Question with Answer & Explanation
The correct answer is B. Registry key: SYSTEM\CurrentControlSet\Enum\USBSTOR. See the full explanation below for the reasoning.
Question
Which Windows artifact stores details about USB devices that were plugged into a system?
Options
- A$MFT
- BRegistry key: SYSTEM\CurrentControlSet\Enum\USBSTOR
- CPrefetch
- DShimcache
Community Discussion
No community discussion yet for this question.