312-49 · Question #700
What is the investigator trying to analyze if the system gives the following image as output?
The correct answer is B. Currently active logon sessions. The output shown (typically from a tool such as Sysinternals LogonSessions or a memory forensics framework like Volatility using the 'logonscan' plugin) displays real-time, live session data pulled from kernel structures or the SAM/LSASS process. This reflects sessions that are…
Question
What is the investigator trying to analyze if the system gives the following image as output?
Options
- AAll the logon sessions
- BCurrently active logon sessions
- CInactive logon sessions
- DDetails of users who can logon
How the community answered
(26 responses)- A4% (1)
- B88% (23)
- C8% (2)
Explanation
The output shown (typically from a tool such as Sysinternals LogonSessions or a memory forensics framework like Volatility using the 'logonscan' plugin) displays real-time, live session data pulled from kernel structures or the SAM/LSASS process. This reflects sessions that are presently authenticated and active on the system, not historical or terminated sessions. Identifying currently active logon sessions is a key step in live forensic triage to detect unauthorized or concurrent access.
Topics
Community Discussion
No community discussion yet for this question.