Computer Hacking Forensic Investigator (CHFI v10) — Question 184

Which of the following is found within the unique instance ID key and helps investigators to map the entry from USBSTOR key to the MountedDevices key?

Answer options

• A. ParentIDPrefix
• B. LastWrite
• C. UserAssist key
• D. MRUListEx key

Correct answer: A

Explanation

The correct answer, ParentIDPrefix, is crucial for correlating the unique instance ID with the entries in USBSTOR and MountedDevices. The other options do not serve this specific mapping function; LastWrite indicates the last modification time, UserAssist key tracks user activity, and MRUListEx key maintains a list of most recently used items but is unrelated to the unique instance ID mapping.