GIAC
GCED · Question #61
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ >…
The correct answer is D. To show hidden and archived files on the d: drive and save the listing to the USB drive. You've hit your limit · resets 1pm (America/New_York)
Data Protection and Incident Response
Question
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt
Options
- ATo create a file on the USB drive that contains a listing of the C: drive
- BTo compare a list of known good hashes on the USB drive to files on the local C: drive
- CTo copy a forensic image of the local C: drive onto the USB drive
- DTo show hidden and archived files on the d: drive and save the listing to the USB drive
How the community answered
(26 responses)- A8% (2)
- B4% (1)
- C15% (4)
- D73% (19)
Explanation
You've hit your limit · resets 1pm (America/New_York)
Topics
#Windows CLI#dir command flags#forensic data collection#hidden file enumeration
Community Discussion
No community discussion yet for this question.