What method of computer forensics will allow you to trace all ever-established user accounts on a Windows
2000 sever the course of its lifetime?
A.
forensic duplication of hard drive
B.
analysis of volatile data
C.
comparison of MD5 checksums
D.
review of SIDs in the Registry
MD5 checksums are used as integrity checks.
User accounts are assigned a unique SID, and the SID are not reused.
Answer: Review of SIDs in the Registry.