What is the primary purpose of using a write blocker when creating a forensic image of a Windows system?

To prevent any changes to the original evidence

To speed up the imaging process

A forensic responder arrives at a scene where a Windows system is running. The responder needs to capture volatile data that would be lost upon shutdown. Which action should be performed first?

Create a forensic image of the hard drive

Run a network scan to identify open ports

Copy the event logs to an external drive

Acquire a memory dump using a tool like WinPmem or FTK Imager

A forensic responder is called to a scene where a Windows system is running and the suspect is actively using it. The responder needs to preserve volatile evidence while minimizing disruption. Which action should be taken first?

Copy the event logs to an external drive

Pull the power cord immediately to preserve the hard drive

Capture a memory dump using a tool that runs from a USB drive

Run a network scan to identify active connections

Which Windows artifact is most useful for determining which files a user recently opened from the File Explorer interface?

Recent Documents (RecentDocs) registry key

EC-CouncilCertified Security Specialist

Domain 6Objective 1

Windows Forensics ECSS Practice Questions (Page 2)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

39questions here

8free pages

10concepts

Questions 6–10

6foundation · easy
What is the primary purpose of using a write blocker when creating a forensic image of a Windows system?
Select an answer first
7foundation · easy
During a forensic examination of a Windows 10 system, an analyst needs to identify which file system feature is most relevant for recovering the original file name of a deleted file that has been moved to a different directory. Which NTFS structure should the analyst examine?
Select an answer first
8application · medium
A forensic responder arrives at a scene where a Windows system is running. The responder needs to capture volatile data that would be lost upon shutdown. Which action should be performed first?
Select an answer first
9expert · hard
A forensic responder is called to a scene where a Windows system is running and the suspect is actively using it. The responder needs to preserve volatile evidence while minimizing disruption. Which action should be taken first?
Select an answer first
10foundation · easy
Which Windows artifact is most useful for determining which files a user recently opened from the File Explorer interface?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.