QuestionQ248

Network Forensics and Traffic Analysis

Adam is a professional Computer Hacking Forensic Investigator assigned to investigate an iPod suspected of containing explicit material. Adam wants to connect the compromised iPod to his system, which runs the Windows XP (SP2) operating system. He is concerned that connecting the iPod to his computer might alter evidence and settings on the iPod. He wants to set the iPod to read-only mode. This can be accomplished by changing a registry key in the Windows XP (SP2) operating system. Which of the following registry keys must Adam change to accomplish this task?

  • A HKEY_LOCAL_MACHINE\CurrentControlset\Control\StorageDevicePolicies
  • B HKEY_LOCAL_MACHINE\System\CurrentControlset\StorageDevicePolicies
  • C HKEY_LOCAL_MACHINE\System\CurrentControlset\Control\StorageDevicePolicies
  • D HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
Explanation

Windows XP SP2 supports write protection for USB block-storage devices through the WriteProtect DWORD value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies. When set to 1, the Windows driver rejects write requests to mounted USB storage devices.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!