212-89 · Question #17
Which of the following is a volatile evidence collecting tool?
The correct answer is A. Netstat. Netstat (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface (and network protocol) statistics. It is considered a volatile evidence collecting tool because it gathers…
Question
Which of the following is a volatile evidence collecting tool?
Options
- ANetstat
- BHashTool
- CFTK Images
- DProDiscover Forensics
How the community answered
(17 responses)- A94% (16)
- C6% (1)
Explanation
Netstat (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface (and network protocol) statistics. It is considered a volatile evidence collecting tool because it gathers information that exists in the system's memory, which is lost upon shutdown or reboot. This makes it invaluable for collecting evidence of active connections and processes that are present at the time of the incident response but does not persistently store data that can be recovered later. This contrasts with tools like FTK Imager or ProDiscover Forensics, which are used for acquiring digital evidence in a non-volatile manner, such as disk imaging, and HashTool, which is used for validating the integrity of collected digital evidence through hashing.
Topics
Community Discussion
No community discussion yet for this question.