Windows Volatile and Non-Volatile Data Collection DFE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In which scenario is live response more appropriate than static acquisition?

   • AWhen the investigator wants to avoid altering any data on the system
   • BWhen the investigator needs to preserve the exact state of the hard drive for later analysis
   • CWhen the system cannot be shut down because it is a critical production server
   • DWhen the system is already powered off and the investigator needs to examine the disk
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During a live response, an investigator collects volatile data and then performs a static acquisition. To maintain a proper chain of custody, which documentation step is essential?

   • ANote the weather conditions at the time of collection.
   • BEmail the collected data to the legal team without encryption.
   • CSave all collected data to the suspect's desktop for easy access.
   • DRecord the investigator's name, date/time, tool versions, and hash values of collected data.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   During a Windows forensic investigation, which of the following is classified as volatile data?

   • AThe Master File Table (MFT)
   • BThe Security event log
   • CThe contents of the Windows registry
   • DThe list of running processes
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An examiner is analyzing a forensic image of a Windows system and needs to extract the user's recently accessed files and typed URLs from the registry. Which tool is specifically designed for this task?

   • ARegRipper
   • BFTK Imager
   • CWindows Event Viewer
   • Dnetstat
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An investigator is performing static acquisition on a seized Windows laptop. The investigator needs to extract user activity artifacts such as recently accessed files and typed URLs, along with system configuration data, without booting the suspect drive. Which approach is most appropriate?

   • AUse netstat to capture network connections from the live system.
   • BMount the drive read-only and use RegRipper to parse registry hives.
   • CBoot the laptop normally and run forensic tools from a USB drive.
   • DRun chkdsk to check the file system for errors.
   Reveal Solution Discussion Select an answer first