GCFA · Question #143
Which of the following command line tools are available in Helix Live acquisition tool on Windows? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. .cab extractors B. ipconfig C. netstat. The Helix Live acquisition tool for Windows bundles several command-line utilities for capturing volatile data, including .cab extractors, ipconfig, and netstat. The whois utility is not included in Helix Live's Windows toolset.
Question
Which of the following command line tools are available in Helix Live acquisition tool on Windows? Each correct answer represents a complete solution. Choose all that apply.
Options
- A.cab extractors
- Bipconfig
- Cnetstat
- Dwhois
How the community answered
(37 responses)- A81% (30)
- D19% (7)
Why each option
The Helix Live acquisition tool for Windows bundles several command-line utilities for capturing volatile data, including .cab extractors, ipconfig, and netstat. The whois utility is not included in Helix Live's Windows toolset.
.cab extractors are included in Helix Live to allow forensic investigators to decompress and examine cabinet archive files encountered during live system acquisition.
ipconfig is bundled within Helix Live on Windows to capture network interface configuration details such as IP addresses and MAC addresses as part of volatile evidence collection.
netstat is included in Helix Live to record active network connections and listening ports on the running system, which constitutes critical volatile evidence that is lost on shutdown.
The whois utility is not included as a command-line tool within Helix Live's Windows toolset - it is a separate network lookup utility that is not part of the Helix acquisition suite.
Concept tested: Helix Live forensic tool command-line utilities
Topics
Community Discussion
No community discussion yet for this question.