Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SANS408 > Registry > Flashcards

Registry Flashcards

1
Q

4 Root Keys of Registry

A

HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Offline Registry File Location

A

\%WINDIR%\system32\config

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Hives Contain

A

Keys - Folders

Values - Data stored in key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

5 Hive Files

A 
Default
SAM
Security
System
Software
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Hive File Location in registry

A

HKEY_LOCAL_MACHINE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

SYSTEM Hive contains

A 
HKEY_LOCAL_MACHINE\SYSTEM
hardware config data
services config data
raw device names for volumes and hard drives
raw device names for USB keys
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

SOFTWARE Hive contains

A

HKEY_LOCAL_MACHINE\SOFTWARE
applications config data
windows programs/products config data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NTUSER.DAT Hive contains

A

slew of user activity

config/environment settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SAM Hive contains

A

HKEY_LOCAL_MACHINE\SAM

local user and group accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

SECURITY Hive

A

password policies
membership and group info
other security information used by SAM and OS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What Systems run RegIdleBackup

A

Vista
Windows 7
Windows 8
Server 2008

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How often does RegIdleBackup run

A

Every 10 days

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does RegIdleBackup do

A

Every 10 days, backs up SAM, DEFAULT, SYSTEM SOFTWARE and SECURITY hives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Where does RegIdleBackup store hives

A

%WinDir%\System32\Config\RegBack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Shadow Copy or RegIdleBackup is disabled usually because of what reasons

A

Processing
Storage Space
This is not necessary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NTUSER.DAT is stored where on Windows XP file system

A

c:\Documents and Settings\NTUSER.dat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

NTUSER.DAT is stored where on Vista/Win7/Win8 file system

A

C:\Users\NTUSER.dat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

USRCLASS.DAT was added to what OS

A

Vista
Win7
Win8

19
Q

Where is USRCLASS.DAT found

A

c:\Users\AppData\Local\Microsoft\Windows\USRCLASS.DAT

20
Q

USRCLASS.DAT is mainly used for what

A

Aid in virtualized registry root for User Account Control (UAC)

21
Q

What is VirtualStore key

A

Where the UAC virtualized registry is

22
Q

Registry can enumerate what file info

A 
last files searched on hard drive
last typed URLs in browsers
last command executed
files that were opened
last saved files to windows system
23
Q

NTUSER.DAT is found where in registry

A

HKEY_USER (more than 1 user logged in) or HKEY_CURRENT_USER (currently logged in user)

24
Q

Registry key help investigations by having what

A

last write time

last time of modification

25
Q

What data can be stored in a registry value

A

strings
binary (hex)
integers
lists

26
Q

Registry last write time is stored in what format

A

UTC

27
Q

When talking about times in registry a common mistake is to do what

A

Not pay attention to UTC or time zone of local machine

28
Q

Registry Viewer by Access Data is used for what

A

Working with Registry Data forensics

29
Q

RegRipper by Harlan Carvey is used for what

A

Working with Registry Data Forensics

30
Q

SAM Hive has what information about a user?

A 
How often user logged in
User last login time
Last failed login
Password Policy
SID to User
31
Q

Where can the OS version be found for a windows system

A

HKLM/Software/Microsoft/WindowsNT/CurrentVersion/

32
Q

Where do you find the current control set being used

A

HKLM/System/Select

33
Q

Where do you find computer name in control set

A

System/CurrentControlSet/Control/ComputerName/ComputerName Used to link log files and computer name

34
Q

Where Identify Current Time zone

A

HKLM/CurrentControlSet/Control/TimeZoneInformation

35
Q

Where do you find network interface cards

A

System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

36
Q

What important information can be found in the registry containing Interfaces data

A 
IP Address  /  gateway / subnet mask
If DHCP was configured
DHCP address that was assigned
DHCP servers IP Address
Interface GUID
37
Q

Windows Vista/Win7/Win8 have this useful forensics data point disabled by default

A

Last Access Timestamp

38
Q

Where is Last Access Timestamp disabled

A

SYSTEM\CurrentControlSet\Control\Filesystem\NtfsDisableLastAccessUpdate set to 0x1 which is disabled

39
Q

Where is interface history found

A

SOFTWARE\Microsoft\Windows_NT\CurrentVersion\NetworkList\Signature\Unmanaged or \Managed
SOFTWARE\Microsoft\Windows_NT\CurrentVersion\NetworkList\Nia\Cache

40
Q

What is Name Type key value for Wireless

A

0x47

41
Q

What is Name Type key value for Wired

A

0x06

42
Q

What is Name Type key value for Broadband

A

0x17

43
Q

What tool converts DateLastConnected and DateFirstConnected Key

A

DeCode

SANS408 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions