What command does a Digital Forensic Examiner use to display the list of all open ports and the associated IP addresses on a victim computer to identify the established connections on it:

Question

Options

• A"netstat -an" command
• B"dd" command
• C"arp" command
• D"ifconfig" command

• A
  88% (46)
• B
  4% (2)
• C
  2% (1)
• D
  6% (3)

Explanation

netstat -an is correct because it displays all (-a) network connections and listening ports in numeric (-n) format, showing the protocol, local/remote IP addresses, ports, and connection state (e.g., ESTABLISHED, LISTEN) - exactly what a forensic examiner needs to map active connections on a compromised system. The dd command is a disk imaging utility used to create bit-for-bit copies of drives, not for network analysis. arp shows the Address Resolution Protocol cache (IP-to-MAC mappings on the local network), useful for identifying hosts but not open ports or connections. ifconfig (or ipconfig on Windows) displays the machine's own network interface configuration, not remote connections.

Memory tip: Think "network statistics" - netstat = network statistics, and the -an flags give you All connections in Numeric form.

No community discussion yet for this question.