What is the primary difference between live response and static acquisition in Windows forensics?

Live response is used only for network forensics; static acquisition is used only for memory forensics.

Live response collects data while the system is running; static acquisition images the disk after shutdown.

Live response is performed after the system is shut down; static acquisition is performed while the system is running.

Live response creates a full disk image; static acquisition only collects registry hives.

An investigator is examining a Windows system that was shut down after a suspected data exfiltration. The investigator needs to recover the last accessed URLs and search terms from the user's web browser. Which non-volatile data source should be examined?

User profile artifacts, such as browser history and cache files

A forensic investigator is collecting volatile data from a Windows server. To ensure the evidence is admissible in court, which documentation step is essential?

Email the collected data to the legal team immediately.

Save all collected data to the system's own hard drive.

Record the exact date and time of collection, tool versions, and compute hashes of the collected data.

Use only GUI tools to avoid command-line errors.

EC-CouncilDigital Forensics Essentials

Domain 4Objective 1

Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 1)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

39questions here

8free pages

8concepts

Questions 1–5

1application · medium
An investigator needs to collect non-volatile data from a Windows system that is already shut down. The investigator wants to preserve the original evidence without modification. Which tool is appropriate for creating a forensic image of the hard drive?
Select an answer first
2foundation · easy
What is the primary difference between live response and static acquisition in Windows forensics?
Select an answer first
3application · medium
An investigator is examining a Windows system that was shut down after a suspected data exfiltration. The investigator needs to recover the last accessed URLs and search terms from the user's web browser. Which non-volatile data source should be examined?
Select an answer first
4foundation · easy
Which tool is specifically designed to parse and analyze Windows registry hives for forensic purposes?
Select an answer first
5application · medium
A forensic investigator is collecting volatile data from a Windows server. To ensure the evidence is admissible in court, which documentation step is essential?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 1)

Questions 1–5

An investigator needs to collect non-volatile data from a Windows system that is already shut down. The investigator wants to preserve the original evidence without modification. Which tool is appropriate for creating a forensic image of the hard drive?

What is the primary difference between live response and static acquisition in Windows forensics?

An investigator is examining a Windows system that was shut down after a suspected data exfiltration. The investigator needs to recover the last accessed URLs and search terms from the user's web browser. Which non-volatile data source should be examined?

Which tool is specifically designed to parse and analyze Windows registry hives for forensic purposes?

A forensic investigator is collecting volatile data from a Windows server. To ensure the evidence is admissible in court, which documentation step is essential?

Keep studying — Operating System Forensics