Question

1.Where are the system, sam, security and software subkeys of HKEY_LOCAL_MACHINE stored?2.The HARDWARE and

SYSTEMCLONE keys are ‘volatile’ — what does this mean?

3.When examining the $MFT file in WinHex, the left-hand pane contains what?

4.The HKEY_USERS keeps track of what?

5.Why is it important to examine copies of the registry rather than the live registry directly?

6.Why are ‘bad clusters’ of interest to the forensics investigator?

7.What is ‘metadata’ – give an example of file metadata

Windows Registry information exists in two forms. What are these two forms?

Looking for a Similar Assignment? Order now and Get 10% Discount! Use Coupon Code "Newclient"