Computer Hacking Forensic Investigator (CHFI v10) — Question 540

Which of the following registry hive gives the configuration information about which application was used to open various files on the system?

Answer options

• A. HKEY_CLASSES_ROOT
• B. HKEY_CURRENT_CONFIG
• C. HKEY_LOCAL_MACHINE
• D. HKEY_USERS

Correct answer: A

Explanation

HKEY_CLASSES_ROOT is the registry hive that stores information about file associations and the applications associated with them. The other options, such as HKEY_CURRENT_CONFIG, HKEY_LOCAL_MACHINE, and HKEY_USERS, serve different purposes related to system configurations and user settings, but do not specifically track application usage for file openings.