Ace Your Exams with Our Notes and Mock Tests!

EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 6 : Windows Forensics
Questions available : 94		You are not logged in. Please Login for track your learning progress

Q. No: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
		Go to Question No.

Question No 0

---

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.

 

---

Bookmark this Question		QID: 826
What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?
A:    forensic duplication of hard drive
B:    analysis of volatile data
C:    comparison of MD5 checksums
D:    review of SIDs in the Registry
Explanation: Registry Analysis: The Windows Registry can contain information about user accounts and their profiles. You can examine the registry to find historical data about user accounts, especially in the "HKEY_LOCAL_MACHINE∖SAM" and "HKEY_LOCAL_MACHINE∖SOFTWARE" hives. In Windows 2000 Server, the Security Identifier (SID) for the local machine can be found in the Windows Registry. The SID is a unique identifier for a Windows system, and it is stored in the registry in the following location: "HKEY_LOCAL_MACHINE∖SECURITY∖SAM∖Domains∖Account" Inside the "Account" key, you will find a subkey named "Users." Within the "Users" key, you can locate a list of user accounts and their corresponding SIDs. The SIDs for user accounts are stored as registry values, and you can identify them by looking at the data associated with these values.