Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An investigator is documenting the collection of volatile data from a Windows system. To ensure the evidence is admissible in court, which piece of information is most critical to record?

   • AThe IP address of the investigator's workstation.
   • BThe exact time and date of collection, along with the tool version used.
   • CThe weather conditions at the time of collection.
   • DThe brand of the computer being investigated.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of non-volatile data that can be collected from a Windows system for forensic analysis?

   • AThe list of active network connections
   • BThe contents of the clipboard
   • CThe Windows event logs
   • DThe list of running processes
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An investigator is triaging a Windows system that is suspected of being compromised. The investigator wants to capture data that will be lost if the system is rebooted. Which of the following should be collected FIRST?

   • ARegistry hives from C:\Windows\System32\config.
   • BUser documents from the Desktop folder.
   • CEvent logs from C:\Windows\System32\winevt\Logs.
   • DContents of RAM, including running processes and network connections.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a volatile data item that should be captured during live response on a Windows system?

   • AThe contents of the pagefile.sys
   • BThe contents of the Recycle Bin
   • CThe system time
   • DThe contents of the Windows registry
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A forensic investigator is responding to a suspected data exfiltration incident on a Windows server. The server is running and the investigator must decide whether to perform a live response or a static acquisition. The server is also a domain controller with active user sessions. Which factor is MOST important in deciding to perform a live response first?

   • AThe need to preserve the integrity of the file system metadata.
   • BThe need to avoid disrupting active user sessions.
   • CThe need to capture volatile data such as active network connections and memory-resident malware.
   • DThe need to collect event logs from the system.
   Reveal Solution Discussion Select an answer first