Which registry hive stores system-wide configuration and hardware information?

Which registry hive stores system-wide configuration and hardware information?

• A. HKEY_LOCAL_MACHINE
• B. HKEY_CURRENT_USER
• C. HKEY_CLASSES_ROOT
• D. HKEY_USERS

Answer: (A)

The registry area that holds information applicable to the entire machine is HKEY_LOCAL_MACHINE. This hive stores system-wide configuration and hardware details that affect every user on the computer, such as hardware configuration, device drivers, and system-wide policies. In a forensic context, examining this hive helps reveal what hardware was present, which drivers were installed, and other settings that apply to the whole system, regardless of which user is logged in. In contrast, the other hives serve different scopes. HKEY_CURRENT_USER contains preferences and settings for the user who is currently logged in, so it reflects per-user customization rather than the whole machine. HKEY_CLASSES_ROOT stores information about registered file types and COM classes, which determine how applications open certain file formats. HKEY_USERS holds the user profiles themselves, including their individual settings, which is broader than a single-user configuration but still not the machine-wide hardware configuration.

The registry area that holds information applicable to the entire machine is HKEY_LOCAL_MACHINE. This hive stores system-wide configuration and hardware details that affect every user on the computer, such as hardware configuration, device drivers, and system-wide policies. In a forensic context, examining this hive helps reveal what hardware was present, which drivers were installed, and other settings that apply to the whole system, regardless of which user is logged in.

In contrast, the other hives serve different scopes. HKEY_CURRENT_USER contains preferences and settings for the user who is currently logged in, so it reflects per-user customization rather than the whole machine. HKEY_CLASSES_ROOT stores information about registered file types and COM classes, which determine how applications open certain file formats. HKEY_USERS holds the user profiles themselves, including their individual settings, which is broader than a single-user configuration but still not the machine-wide hardware configuration.