312-49 · Question #679
What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?
The correct answer is C. System CheckPoints required for restoring. The rp.log file is found within Windows System Restore point directories (e.g., under System Volume Information). It contains records of the system checkpoints - including what changes were captured - that are required to restore the system to a prior state. Forensic…
Question
What is an investigator looking for in the rp.log file stored in a system running on Windows 10 operating system?
Options
- ARestore point interval
- BAutomatically created restore points
- CSystem CheckPoints required for restoring
- DRestore point functions
How the community answered
(59 responses)- A2% (1)
- B2% (1)
- C93% (55)
- D3% (2)
Explanation
The rp.log file is found within Windows System Restore point directories (e.g., under System Volume Information). It contains records of the system checkpoints - including what changes were captured - that are required to restore the system to a prior state. Forensic investigators examine this file to understand what restore points exist and what system state they capture, not to find intervals, automated scheduling triggers, or functional metadata.
Topics
Community Discussion
No community discussion yet for this question.