nerdexam
GIAC

GCFA · Question #143

Which of the following command line tools are available in Helix Live acquisition tool on Windows? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. .cab extractors B. ipconfig C. netstat. The Helix Live acquisition tool for Windows bundles several command-line utilities for capturing volatile data, including .cab extractors, ipconfig, and netstat. The whois utility is not included in Helix Live's Windows toolset.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Which of the following command line tools are available in Helix Live acquisition tool on Windows? Each correct answer represents a complete solution. Choose all that apply.

Options

  • A.cab extractors
  • Bipconfig
  • Cnetstat
  • Dwhois

How the community answered

(37 responses)
  • A
    81% (30)
  • D
    19% (7)

Why each option

The Helix Live acquisition tool for Windows bundles several command-line utilities for capturing volatile data, including .cab extractors, ipconfig, and netstat. The whois utility is not included in Helix Live's Windows toolset.

A.cab extractorsCorrect

.cab extractors are included in Helix Live to allow forensic investigators to decompress and examine cabinet archive files encountered during live system acquisition.

BipconfigCorrect

ipconfig is bundled within Helix Live on Windows to capture network interface configuration details such as IP addresses and MAC addresses as part of volatile evidence collection.

CnetstatCorrect

netstat is included in Helix Live to record active network connections and listening ports on the running system, which constitutes critical volatile evidence that is lost on shutdown.

Dwhois

The whois utility is not included as a command-line tool within Helix Live's Windows toolset - it is a separate network lookup utility that is not part of the Helix acquisition suite.

Concept tested: Helix Live forensic tool command-line utilities

Topics

#Helix forensics tool#live acquisition#forensic tools#incident response

Community Discussion

No community discussion yet for this question.

Full GCFA Practice