An examiner has a memory dump and a disk image from a Windows system. The examiner wants to build a comprehensive timeline of system activity, including process execution, network connections, and logon events. Which approach would best correlate these data sources?

Use the memory dump to generate a timeline with Volatility's timeliner plugin and ignore the disk image because it is redundant.

Only analyze the disk image because it contains persistent artifacts and is more reliable than memory dumps.

Extract process and network information from the memory dump using Volatility, and extract logon events from the Security event log on the disk image, then merge the timelines by timestamp.

Only analyze the memory dump because it contains all volatile data and is more reliable than disk artifacts.

An investigator is reconstructing a user's activities on a Windows 10 machine. The user is suspected of opening a confidential document from a network share and then browsing a specific website. Which artifacts would provide the most direct evidence of these actions?

LNK files in Recent Items and browser history files

Registry UserAssist and MountedDevices

Event logs Security ID 4624 and System ID 7045

EC-CouncilDigital Forensics Essentials

Domain 4Objective 2

Windows Memory and Artifact Analysis DFE Practice Questions (Page 5)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

50questions here

10free pages

9concepts

Questions 21–25

21application · medium
An investigator is examining a Windows 10 system and needs to find evidence of user logon activity. Which Windows artifact should be examined?
Select an answer first
22foundation · easy
Which Windows artifact is used to speed up application startup and can indicate program execution history?
Select an answer first
23application · medium
An examiner has a memory dump and a disk image from a Windows system. The examiner wants to build a comprehensive timeline of system activity, including process execution, network connections, and logon events. Which approach would best correlate these data sources?
Select an answer first
24application · medium
An investigator is reconstructing a user's activities on a Windows 10 machine. The user is suspected of opening a confidential document from a network share and then browsing a specific website. Which artifacts would provide the most direct evidence of these actions?
Select an answer first
25foundation · easy
In Volatility, which plugin is used to list active processes from a memory dump?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Windows Memory and Artifact Analysis DFE Practice Questions (Page 5)

Questions 21–25

An investigator is examining a Windows 10 system and needs to find evidence of user logon activity. Which Windows artifact should be examined?

Which Windows artifact is used to speed up application startup and can indicate program execution history?

An examiner has a memory dump and a disk image from a Windows system. The examiner wants to build a comprehensive timeline of system activity, including process execution, network connections, and logon events. Which approach would best correlate these data sources?

An investigator is reconstructing a user's activities on a Windows 10 machine. The user is suspected of opening a confidential document from a network share and then browsing a specific website. Which artifacts would provide the most direct evidence of these actions?

In Volatility, which plugin is used to list active processes from a memory dump?

Keep studying — Operating System Forensics