Which of the following is a common method to acquire volatile memory from a Windows system?

Using a tool like FTK Imager to create a memory dump.

Using the 'memdump' command in the Windows command prompt.

Running the 'copy' command on the pagefile.sys file.

Copying the contents of the C:\Windows\System32 folder.

An investigator is analyzing a Windows system and finds that the Prefetch folder is empty. The investigator suspects that a specific program was executed. Which artifact could provide evidence of execution despite the empty Prefetch folder?

Shimcache (AppCompatCache) in the SYSTEM registry hive

EC-CouncilDigital Forensics Essentials

Domain 4Objective 2

Windows Memory and Artifact Analysis DFE Practice Questions (Page 10)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

50questions here

10free pages

9concepts

Questions 46–50

46application · medium
An analyst has a memory dump from a Windows system and needs to extract the list of network connections that were active at the time of acquisition. Which Volatility plugin should be used?
Select an answer first
47foundation · easy
Which file system artifact contains the master file table (MFT) on an NTFS volume?
Select an answer first
48foundation · easy
Which of the following is a common method to acquire volatile memory from a Windows system?
Select an answer first
49foundation · easy
Which Windows artifact is used to recover files that were deleted by the user?
Select an answer first
50expert · hard
An investigator is analyzing a Windows system and finds that the Prefetch folder is empty. The investigator suspects that a specific program was executed. Which artifact could provide evidence of execution despite the empty Prefetch folder?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Windows Memory and Artifact Analysis DFE Practice Questions (Page 10)

Questions 46–50

An analyst has a memory dump from a Windows system and needs to extract the list of network connections that were active at the time of acquisition. Which Volatility plugin should be used?

Which file system artifact contains the master file table (MFT) on an NTFS volume?

Which of the following is a common method to acquire volatile memory from a Windows system?

Which Windows artifact is used to recover files that were deleted by the user?

An investigator is analyzing a Windows system and finds that the Prefetch folder is empty. The investigator suspects that a specific program was executed. Which artifact could provide evidence of execution despite the empty Prefetch folder?

Keep studying — Operating System Forensics