nerdexam
GIAC

GCFA · Question #187

Allen works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a computer, which is used by the suspect to sexually harass the victim using…

The correct answer is B. MessenPass. MessenPass is the Helix Live utility specifically designed to recover passwords stored by instant messenger applications on Windows systems.

Advanced Windows Artifacts & Browser Forensics

Question

Allen works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a computer, which is used by the suspect to sexually harass the victim using instant messenger program. Suspect's computer runs on Windows operating system. Allen wants to recover password from instant messenger program, which suspect is using, to collect the evidence of the crime. Allen is using Helix Live for this purpose. Which of the following utilities of Helix will he use to accomplish the task?

Options

  • AMail Pass View
  • BMessenPass
  • CAsterisk Logger
  • DAccess PassView

How the community answered

(29 responses)
  • A
    3% (1)
  • B
    76% (22)
  • C
    14% (4)
  • D
    7% (2)

Why each option

MessenPass is the Helix Live utility specifically designed to recover passwords stored by instant messenger applications on Windows systems.

AMail Pass View

Mail Pass View is designed to recover passwords stored in email clients such as Outlook and Thunderbird, not instant messenger applications.

BMessenPassCorrect

MessenPass is a dedicated password recovery tool included in the Helix forensic toolkit that targets instant messaging applications such as MSN Messenger, Yahoo Messenger, ICQ, and AIM. Because the suspect used an instant messenger program to commit harassment, MessenPass is the correct tool to extract the stored credentials as admissible digital evidence. Its specific focus on instant messaging protocols makes it directly applicable to this investigation scenario.

CAsterisk Logger

Asterisk Logger reveals and logs passwords hidden behind asterisk characters in active password fields, and does not recover credentials stored by instant messenger programs.

DAccess PassView

Access PassView recovers passwords from Microsoft Access database files and has no capability to retrieve instant messenger credentials.

Concept tested: Instant messenger password recovery using Helix forensic tools

Source: https://www.nirsoft.net/utils/mspass.html

Topics

#Helix Live#MessenPass#instant messenger forensics#password recovery tools

Community Discussion

No community discussion yet for this question.

Full GCFA Practice