Richard is extracting volatile data from a system and uses the command doskey/history. What is he trying to extract?

The correct answer is B. Previously typed commands. The doskey /history command in Windows displays a list of all commands that have been typed in the current Command Prompt session. It is a built-in Windows utility that buffers command-line input, allowing users (and forensic investigators) to retrieve previously entered commands

Submitted by emma.c· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AEvents history
BPreviously typed commands
CHistory of the browser
DPasswords used across the system

How the community answered

(48 responses)

A
6% (3)
B
88% (42)
C
4% (2)
D
2% (1)

Explanation

The doskey /history command in Windows displays a list of all commands that have been typed in the current Command Prompt session. It is a built-in Windows utility that buffers command-line input, allowing users (and forensic investigators) to retrieve previously entered commands. This is particularly valuable in digital forensics as volatile data - commands typed by a suspect - can be recovered before the session closes and the buffer is lost.

Topics

#Volatile data#Windows commands#Command history#Live forensics

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice