A forensic investigator is analyzing a Windows 10 system and needs to find evidence of USB device usage. Which registry key should be examined?

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

An investigator must acquire forensic evidence from a running Windows server that hosts a critical database. The server cannot be shut down. Which acquisition strategy best balances evidentiary integrity with system availability?

Perform a physical acquisition of the entire disk using a hardware write blocker

Perform a live acquisition of volatile memory first, then create a logical image of active files

Perform a network-based acquisition of the entire disk while the system is running

Perform a memory dump only, and skip disk acquisition to avoid disruption

A forensic examiner needs to create a forensic image of a Windows 10 system's hard drive. The examiner must ensure the image is an exact bit-for-bit copy and that the original drive is not altered. Which tool and approach should be used?

Use Windows Backup to create a system image

Use the 'sfc /scannow' command to verify system files

Use FTK Imager to create a raw image and compute a SHA-256 hash of the original and the image

Copy all files to an external drive using File Explorer

EC-CouncilCertified Security Specialist

Domain 6Objective 1

Windows Forensics ECSS Practice Questions (Page 5)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

39questions here

8free pages

10concepts

Questions 21–25

21foundation · easy
Which tool is specifically designed for analyzing volatile memory (RAM) in Windows systems?
Select an answer first
22application · medium
A forensic investigator is analyzing a Windows 10 system and needs to find evidence of USB device usage. Which registry key should be examined?
Select an answer first
23expert · hard
An investigator must acquire forensic evidence from a running Windows server that hosts a critical database. The server cannot be shut down. Which acquisition strategy best balances evidentiary integrity with system availability?
Select an answer first
24foundation · easy
In Windows file system forensics, which timestamp indicates the last time the content of a file was modified?
Select an answer first
25application · medium
A forensic examiner needs to create a forensic image of a Windows 10 system's hard drive. The examiner must ensure the image is an exact bit-for-bit copy and that the original drive is not altered. Which tool and approach should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Windows Forensics ECSS Practice Questions (Page 5)

Questions 21–25

Which tool is specifically designed for analyzing volatile memory (RAM) in Windows systems?

A forensic investigator is analyzing a Windows 10 system and needs to find evidence of USB device usage. Which registry key should be examined?

An investigator must acquire forensic evidence from a running Windows server that hosts a critical database. The server cannot be shut down. Which acquisition strategy best balances evidentiary integrity with system availability?

In Windows file system forensics, which timestamp indicates the last time the content of a file was modified?

A forensic examiner needs to create a forensic image of a Windows 10 system's hard drive. The examiner must ensure the image is an exact bit-for-bit copy and that the original drive is not altered. Which tool and approach should be used?

Keep studying — Digital Forensics Investigations