CHFI OS and Network Forensics Practice Question
In a Windows forensic investigation, which registry key is used to examine programs that automatically start at system boot for all users?
⚠ Common exam trap
EC-Council often tests the distinction between system-wide (HKLM) and per-user (HKCU) Run keys, and candidates mistakenly choose HKEY_CURRENT_USER because it is more commonly referenced in everyday Windows use, forgetting the 'for all users' requirement in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key stores programs that automatically start at system boot for all users. This is a system-wide location, meaning any executable listed here runs regardless of which user logs in, making it critical for forensic analysis of persistent malware or unauthorized startup applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Why it's wrong here
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run is the per-user startup key and is only processed for the currently logged-in account. Because HKCU mounts the active user's NTUSER.DAT hive, any program listed here launches exclusively under that user's session, not for other profiles. In a multi-user forensic context, this key cannot satisfy a requirement for all users.
- ✗
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Why it's wrong here
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services contains the system's service controller configuration, defining service start types, binary paths, and dependencies. Although services with a start value of Auto start at boot, this key is not the persistent startup location for general applications and does not use the same Run semantics. It is incorrect because it governs services rather than the shell-level autostart entries that would apply to every user.
- ✓
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Why this is correct
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run is the correct answer because it is a machine-wide authority under the HKLM root, which is visible to and processed for every user who logs onto the system. Programs specified in its String or ExpandString values are executed automatically with the user's privileges at each logon. This persistence location is commonly targeted by malware, and forensic analysts check it to identify software that runs for all users.
- ✗
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
Why it's wrong here
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run references the offline hive file for a particular user profile, not a system-wide registry key. Each user profile contains its own NTUSER.DAT, so a Run entry there only affects that specific user. Additionally, this path is not a valid live registry path; it is a file on disk that must be mounted, making it unsuitable as the answer for all users.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.