A forensic investigator is collecting volatile data from a Windows system and must ensure the evidence is admissible in court. The investigator has collected the output of netstat, tasklist, and openfiles. Which additional step is critical to maintain the chain of custody?

Use a GUI tool to display the output to the legal team.

Save the output to the system's own hard drive for later analysis.

Record the exact time of collection, tool versions, and compute hashes of the output files.

Email the output to the legal team immediately.

A forensic investigator is called to respond to a suspected malware infection on a Windows 10 workstation that is still powered on. The investigator must preserve the maximum amount of evidence. Which action should be performed first?

Run a full antivirus scan to identify the malware.

Copy the Windows event logs to an external drive.

Capture the contents of RAM using a memory acquisition tool.

Create a forensic image of the hard drive using a write-blocker.

Which of the following is a non-volatile Windows artifact that can provide evidence of user activity?

The user's NTUSER.DAT registry hive

The network connections established by the system

EC-CouncilDigital Forensics Essentials

Domain 4Objective 1

Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 6)

Part of the Operating System Forensics domain, which makes up ~15% of our current practice bank.

39questions here

8free pages

8concepts

Questions 26–30

26expert · hard
A forensic investigator is collecting volatile data from a Windows system and must ensure the evidence is admissible in court. The investigator has collected the output of netstat, tasklist, and openfiles. Which additional step is critical to maintain the chain of custody?
Select an answer first
27foundation · easy
Which Windows command-line tool is used to display the list of running processes for volatile data collection?
Select an answer first
28application · medium
An incident responder is called to a scene where a Windows workstation is still running. The responder must decide which data to collect first. Which item is the MOST volatile and should be collected first?
Select an answer first
29application · medium
A forensic investigator is called to respond to a suspected malware infection on a Windows 10 workstation that is still powered on. The investigator must preserve the maximum amount of evidence. Which action should be performed first?
Select an answer first
30foundation · easy
Which of the following is a non-volatile Windows artifact that can provide evidence of user activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 6)

Questions 26–30

A forensic investigator is collecting volatile data from a Windows system and must ensure the evidence is admissible in court. The investigator has collected the output of netstat, tasklist, and openfiles. Which additional step is critical to maintain the chain of custody?

Which Windows command-line tool is used to display the list of running processes for volatile data collection?

An incident responder is called to a scene where a Windows workstation is still running. The responder must decide which data to collect first. Which item is the MOST volatile and should be collected first?

A forensic investigator is called to respond to a suspected malware infection on a Windows 10 workstation that is still powered on. The investigator must preserve the maximum amount of evidence. Which action should be performed first?

Which of the following is a non-volatile Windows artifact that can provide evidence of user activity?

Keep studying — Operating System Forensics