1. __________ was the first Windows operating system to support FAT32.

2. How many hives are in the Windows Registry?

1. 1

2. 2

3. 5

4. 8

3. Stack memory is stored in a first-in, last-out format.

1. True

2. False

4. Which of the following is a concern for capturing live data that is caused by data being changed as it is being captured?

1. Slurred image

2. Corrupt image

3. Data corruption

4. Memory fragmenting

5. In Windows 7, the swap file ends with what extension?

1. .sys

2. .swp

3. .swap

4. .vmem

6. You are examining a Windows 7 laptop. The suspect is accused of having illegal pornographic images on the laptop. The suspect insists that he did not know the images were on the laptop, so you decide to examine the Windows Registry to find evidence that he did access the folder in which the images are stored. Which of the following Registry keys would help you do this?

1. ShellBag

2. Prefetch

3. UserAssist

4. DeskIcon

5. LNK

7. Juan is working on a case involving an employee who has been accused of visiting sites that violate company policy. He feels certain that there will be plenty of evidence, if he can extract the browser history. Juan would like to extract the employee’s browser history. Where does Internet Explorer store history?

1. Registry

2. index.dat

3. Webcache.dat

4. history.dat

8. Ahmed is looking for Registry entries that reflect the settings of the last known good boot of a given Registry key. __________ could be what is known as the last known good control set, or the control set that last successfully booted Windows.

1. Controlset001

2. Controlset002

3. Currentcontrolset

4. Clone

9. Danielle is a forensic analyst with a private investigation firm. She has been asked to investigate a laptop that is suspected of being involved in the hacking of the organization’s server. Danielle wants to find all the values typed into the Run box in the Start menu. Which of the following Registry keys should she check to find this information?

1. UserAssist key

2. MountedDevices key

3. RunMRU key

4. TypedURLs key