The following registry key would be interesting to recover the system state. Why? SYSTEM CurrentControlSet$\backslash$ControllCrashControl$\backslash$CrashDumpEnable

a$.$ Because it contains information about the times system has been shut down or restarted

b$.$ Because it informs if a dumpfile was created

c$.$ Because it contains information about the system upgrades

d$.$ Because it informs about failed log in attempts