What is the investigator trying to view by issuing the command displayed in the following screenshot?

The correct answer is D. List of services installed. Without seeing the screenshot, this question refers to a command used to enumerate all services installed on a system - regardless of whether they are running or stopped. On Windows systems, commands such as 'sc query type= all state= all' or 'Get-Service' (PowerShell) list…

Submitted by saadiq_pk· Apr 18, 2026Disk Forensics

Question

Exhibit

Options

AList of services stopped
BList of services closed recently
CList of services recently started
DList of services installed

How the community answered

(40 responses)

A
3% (1)
B
8% (3)
C
3% (1)
D
88% (35)

Explanation

Without seeing the screenshot, this question refers to a command used to enumerate all services installed on a system - regardless of whether they are running or stopped. On Windows systems, commands such as 'sc query type= all state= all' or 'Get-Service' (PowerShell) list every installed service. Forensic investigators run this command during triage to build a full inventory of installed services, which can help identify unauthorized or malicious services that an attacker may have installed for persistence.

Topics

#System Services#Operating System Analysis#Command Line Interface#System Configuration

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice