Set 3 Flashcards
Which areas of a windows host should you focus on investigating for windows information?
Registry, event logs, memory
Running commands on a suspects windows system, what is the best practice?
Run windows commands from a USB drive.
Out of these what would not be considered volatile evidence?
Open shares and files
Running processes
Network connections
Shadow volume copies
Shadow volume copies
Where to collect windows based tool?
Windows system control center
Which command would a forensics analyst use to determine what processes are running on windows based system?
Tasklist
Which command would be used to list active network connections?
Netstat
What does this command do?
Net users»_space; output.txt
Appends the information to a txt file.
» always has something to do with append
Juanita is performing windows laptop search, consent and search and seizure form, wants to make a copy of the contents of physical memory of the host, what does she use?
Dumpit
Forensic analyst on windows host, a registry key shows ClearpagefileatShutdown, what does this mean?
No virtual memory
Which registry hive is populated once the user logs in?
current user
Which is not considered a main give of registry?
Config update
Metadata is encrypted and hidden in a different file, True or false
false
Windows based laptop investigation, suspect may have installed malware on purpose, to confirm John runs in vm, what analysis is this?
Dynamic
Which area is best for investigation for users suspicious internet related activities?
Browser cache
In an investigation Liv uses volatility, employee wont give password, she tries every possible password to enter computer, what method is this called?
Brute force attack
