EMCS642 – Digital Forensics
(Lab Activity-1 – Individual Work)
EMCS642 – Digital Forensics
(Lab Activity-1) – Answer Template
Student Name Student ID
1
Task-1: Examining SAM Hive
i. The Registry contains how many hives?
a. Three b. Two c. Five d. Six
2
ii. How many user accounts are disabled?
a. Two b. Seven c. One d. Three
Two user accounts are disabled; The guest account and the administrator account.
3
iii. SAM hive uses PIDs to store information on user accounts.
a. True b. False
False. SAM hive does not use PIDs to store user account information. The SAM (Security
Account Manager) hive stores user account details using Security Identifiers (SIDs) rather
than Process Identifiers (PIDs). Each user and group is assigned a unique SID, which
includes a domain identifier and a Relative Identifier (RID) that differentiates individual
accounts. In this case, the Administrator account is assigned RID 500, and the Guest account
has RID 501. These SIDs, along with their RIDs, are used to control access and manage
account information within the system.
4
5
iv. Name two SID values that indicate whether an account was created automatically.
1. S-1-5-21-3753288152-1297746280-3161794701-501 Guest 2014-02-06 13:40:57
2. S-1-5-21-3753288152-1297746280-3161794701-500 Administrator 2014-02-06 13:40:57
The timestamps illustrate that both Administrator and Guest accounts were created
simultaneously (at 2014-02-06 13:40:57). This suggests that these were automatically
generated accounts, as is the case with any system-generated account, i.e., Administrator,
Guest, etc., typically created during installation or initial configuration of the system.
6
v. The Key Properties pane in Registry Viewer shows when user accounts have changed
their passwords.
a. True b. False
7
8
Task-2 - Examining SYSTEM Hive
i. What’s the computer name of this system?
a. Mnmsrv b. GCFI5E c. HAL d. MSDTC
ii. What’s the time zone setting for this computer?
a. EST b. MST c. CST d. PST
9
iii. How many mounted devices on this system have assigned drive letters?
Two drives are mounted; Drive C and D
iv. What information is stored in the Enum folder?
a. User account information b. Password information
c. File locations d. HW and SW values
10
v. The SYSTEM hive contains configuration data for passwords.
a. True b. False
The SYSTEM hive in the Windows Registry contains configuration data for system settings,
including hardware and system services, but not user passwords. User passwords are
typically stored in the SAM (Security Accounts Manager) hive.
11
Task 3: Examining [Link] Registry File
i. [Link] file contains information on multiple account holders.
[Link] b. False
The [Link] file contains user-specific settings and preferences for a single user account,
not multiple account holders. Each user account has its own [Link] file.
12
ii. What’s the e-mail account for the Denise user?
a. [Link]@.[Link] b. Denise@[Link]
c. denise.robinson5@[Link] d. denise.robinson5@[Link]
iii. [Link] file contains information on which of the following?
a. Drive letter designations b. Personalized desktop settings
c. PID key d. MRU devices
13
iv. Password decryption tools often need which of the following to retrieve user passwords?
(Choose all that apply.)
a. SYSTEM hive b. SAM hive c. [Link] file d. Enum folder
The SYSTEM hive contains configuration data related to the system and is used in
conjunction with the SAM hive, which stores the hashed passwords for user accounts.
14
15
v. [Link] file is in which of the following paths?
a. C:\Windows\System32\Config b. C:\Documents and Settings\Users
c. C:\Users\username d. C:\SYSTEM
16