GCFA: GIAC Certified Forensic AnalystDemo

By GIAC · Question Mode

QuestionQ13

Windows Artifact Analysis

Which of the following Windows Registry keys contains the user’s password file?

  • A HKEY_USER
  • B HKEY_CURRENT_CONFIG
  • C HKEY_DYN_DATA
  • D HKEY_LOCAL_MACHINE
Explanation

Local Windows account password hashes are stored in the Security Account Manager (SAM) database, which is in the HKEY_LOCAL_MACHINE registry hive. Windows stores password hashes rather than plaintext passwords.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!