Derived from Digital Evidence Analysis using the Axiom Examine application: THE SHELLBAGS ARTIFACT CATEGORY IS PARSED FROM WHICH WINDOWS REGISTRY FILE?
a) SYSTEM
b) SOFTWARE
c) NTUSER.DAT
d) SECURITY