What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?

A.
forensic duplication of hard drive

B.
analysis of volatile data

C.
comparison of MD5 checksums

D.
review of SIDs in the Registry

Discussion

One Response to “What method of computer forensics will allow you to trace all ever-established user accounts on a Windows 2000 sever the course of its lifetime?”

  1. val says:

    Wrong answer….should be registry and SID

Leave a Reply