GIAC

GCFE · Question #134

What Windows Registry hive would you analyze for user-specific evidence?

The correct answer is D. NTUSER.DAT. See the full explanation below for the reasoning.

Question

What Windows Registry hive would you analyze for user-specific evidence?

Options

ASYSTEM
BSAM
CSECURITY
DNTUSER.DAT

How the community answered

(28 responses)

A
4% (1)
B
4% (1)
C
11% (3)
D
82% (23)

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full GCFE Practice