FTK provides tools to search and analyze which Windows data store?

FTK provides tools to search and analyze which Windows data store?

• A. Event logs
• B. Windows Registry
• C. System32 directory
• D. Temporary files

Answer: (B)

Windows Registry is the central data store Windows uses to hold configuration, settings, and state information for the OS and installed software. FTK includes a Registry Viewer and parsing tools that search and analyze the registry hives (for example, SOFTWARE, SYSTEM, SAM) to uncover artifacts like installed programs, user preferences, startup items, and user activity. Because the registry is a structured, centralized database of configuration data, it’s the primary Windows data store FTK is used to search and analyze in this context. While FTK can examine other data sources such as event logs, the System32 directory, or temporary files, those are separate data types and not the primary registry data store FTK targets for this question.

Windows Registry is the central data store Windows uses to hold configuration, settings, and state information for the OS and installed software. FTK includes a Registry Viewer and parsing tools that search and analyze the registry hives (for example, SOFTWARE, SYSTEM, SAM) to uncover artifacts like installed programs, user preferences, startup items, and user activity. Because the registry is a structured, centralized database of configuration data, it’s the primary Windows data store FTK is used to search and analyze in this context. While FTK can examine other data sources such as event logs, the System32 directory, or temporary files, those are separate data types and not the primary registry data store FTK targets for this question.