GCED · Question #1
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d:\ >…
The correct answer is C. To copy a forensic image of the local C: drive onto the USB drive. This command will create a text file on the collection media (in this case you would probably be using a USB flash drive) named IRCD.txt that should contain a recursive directory listing of all files on the desk.
Question
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d:\ > a: \ IRCD.txt
Options
- ATo create a file on the USB drive that contains a listing of the C: drive
- BTo show hidden and archived files on the C: drive and copy them to the USB drive
- CTo copy a forensic image of the local C: drive onto the USB drive
- DTo compare a list of known good hashes on the USB drive to files on the local C: drive
How the community answered
(43 responses)- A5% (2)
- B12% (5)
- C81% (35)
- D2% (1)
Explanation
This command will create a text file on the collection media (in this case you would probably be using a USB flash drive) named IRCD.txt that should contain a recursive directory listing of all files on the desk.
Topics
Community Discussion
No community discussion yet for this question.