Digital forensics

14. Which of the following is/are true regarding Windows users and the registry hives? 1. HKEY_USERS holds the default information for all users. It is loaded when the system boots. 2. HKEY_CLASSES_ROOT holds the default information for all users. It is loaded when the system boots. 3. HKEY_CURRENT_USER holds the default information for all users. It is loaded when the system boots. 4. HKEY_LOCAL_MACHINE holds the default information for all users. It is loaded when the system boots. 5. HKEY_CURRENT_CONFIG holds the changes to the default settings for an individual user. These changes are loaded into registry when the user logs in. 6. HKEY_USERS holds the changes to the default settings for an individual user. These changes are loaded into registry when the user logs in. 7. HKEY_CLASSES_ROOT holds the changes to the default settings for an individual user. These changes are loaded into registry when the user logs in. 8. HKEY_CURRENT_USER holds the changes to the default settings for an individual user. These changes are loaded into registry when the user logs in. 9. None of the above 15. True or False. All of the information in the HKEY_LOCAL_MACHINE hive is stored in the file SYSTEM file when Windows shuts down. (The full path to the file is typically C:Windows\System32\config\SYSTEM. 1. True 2. False 16. True or False. The information in HKEY_CURRENT_CONFIG is actually part of HKEY_LOCAL_MACHINE, so it is not stored in a separate file when Windows shuts down. 1. True 2. False