GCFA · Question #114
Adam works as a professional Computer Hacking Forensic Investigator. He has been assigned with a project to investigate a computer in the network of SecureEnet Inc. The compromised system runs on…
The correct answer is A. FSP. In Helix Live for Windows, the FSP (Forensic Server Project) component is used to capture volatile data from a live Windows system and transmit it to a remote server over TCP/IP.
Question
Adam works as a professional Computer Hacking Forensic Investigator. He has been assigned with a project to investigate a computer in the network of SecureEnet Inc. The compromised system runs on Windows operating system. Adam decides to use Helix Live for Windows to gather data and electronic evidences starting with retrieving volatile data and transferring it to server component via TCP/IP. Which of the following application software in Helix Windows Live will he use to retrieve volatile data and transfer it to the server component via TCP/IP?
Options
- AFSP
- BDrive Manager
- CFTK imager
- DFAU
How the community answered
(49 responses)- A80% (39)
- B12% (6)
- C6% (3)
- D2% (1)
Why each option
In Helix Live for Windows, the FSP (Forensic Server Project) component is used to capture volatile data from a live Windows system and transmit it to a remote server over TCP/IP.
FSP (Forensic Server Project) is the application within Helix Live for Windows specifically designed to retrieve volatile data such as running processes, network connections, and memory contents from a live system and transfer that data securely to a remote server component via a TCP/IP connection, making it the correct tool for live network-based evidence acquisition.
Drive Manager in Helix is used for managing and imaging physical drives, not for capturing volatile memory data and transmitting it over TCP/IP.
FTK Imager is a disk and memory imaging tool used to create forensic images of storage media, not for streaming volatile data to a remote server via TCP/IP.
FAU (File Allocation Units) is a utility for examining file system allocation structures on disk, not for live volatile data acquisition and network transfer.
Concept tested: Helix Live FSP volatile data acquisition over TCP/IP
Topics
Community Discussion
No community discussion yet for this question.