According to the order of volatility, which of the following should be collected first during a live Windows forensic investigation?

Contents of system memory (RAM)

A company's legal team wants to preserve evidence from a laptop that is currently running and connected to the corporate network. The laptop is suspected of being used for unauthorized access. The investigator must preserve both volatile and non-volatile evidence. What is the most appropriate approach?

Perform a live response to collect volatile data, then shut down and create a forensic image of the disk.

Copy the entire hard drive to an external USB drive while the system is running.

Run a network capture tool for several hours before collecting any data.

Immediately pull the power plug and then create a forensic image of the disk.

EC-CouncilDigital Forensics Essentials

Domain 4Objective 1

Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 3)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

39questions here

8free pages

8concepts

Questions 11–15

11foundation · easy
Which tool is specifically used to capture active network connections during live response on a Windows system?
Select an answer first
12foundation · easy
In the standard order of volatility, which of the following is the LEAST volatile and should be collected last?
Select an answer first
13foundation · easy
According to the order of volatility, which of the following should be collected first during a live Windows forensic investigation?
Select an answer first
14application · medium
A company's legal team wants to preserve evidence from a laptop that is currently running and connected to the corporate network. The laptop is suspected of being used for unauthorized access. The investigator must preserve both volatile and non-volatile evidence. What is the most appropriate approach?
Select an answer first
15application · medium
During a live response, an investigator needs to capture the current network connections and listening ports on a Windows system to identify potential command-and-control communication. Which tool should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 3)

Questions 11–15

Which tool is specifically used to capture active network connections during live response on a Windows system?

In the standard order of volatility, which of the following is the LEAST volatile and should be collected last?

According to the order of volatility, which of the following should be collected first during a live Windows forensic investigation?

During a live response, an investigator needs to capture the current network connections and listening ports on a Windows system to identify potential command-and-control communication. Which tool should be used?

Keep studying — Operating System Forensics